Analysis

  • max time kernel
    123s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    23-07-2021 13:11

General

  • Target

    AFBC5B04B75F1AD031B50355F856179A.exe

  • Size

    1.9MB

  • MD5

    afbc5b04b75f1ad031b50355f856179a

  • SHA1

    f755d0b70c8ada93edd17ed38e19a69cafbb9aee

  • SHA256

    1c5088ac5461153a35eaf852a6fee84df1a6e32277426844c0cc5593ed6670b4

  • SHA512

    0da9d121d539f4771b1e5202233e064fa75ccc9db21651ad17838ab94c6ee807658560638d2b160376c5c1a6be77de82a28e6837f7f117fbea7b73ae19ea630a

Malware Config

Extracted

Family

fickerstealer

C2

37.0.8.225:80

Extracted

Family

vidar

Version

39.7

Botnet

865

C2

https://shpak125.tumblr.com/

Attributes
  • profile_id

    865

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32
rc4.i32

Signatures

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 7 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE GCleaner Downloader Activity M1
  • suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)
  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
  • suricata: ET MALWARE Win32/Ficker Stealer Activity M3
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 4 IoCs
  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 64 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 23 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 13 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Kills process with taskkill 4 IoCs
  • Modifies data under HKEY_USERS 14 IoCs
  • Modifies registry class 20 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
    • Drops file in System32 directory
    PID:1040
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Themes
    1⤵
      PID:1204
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s SENS
      1⤵
        PID:1416
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
        1⤵
          PID:2364
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Browser
          1⤵
            PID:2596
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s WpnService
            1⤵
              PID:2672
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2692
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
              1⤵
                PID:2380
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                1⤵
                  PID:1852
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1396
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1164
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                      1⤵
                        PID:1000
                      • C:\Users\Admin\AppData\Local\Temp\AFBC5B04B75F1AD031B50355F856179A.exe
                        "C:\Users\Admin\AppData\Local\Temp\AFBC5B04B75F1AD031B50355F856179A.exe"
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4092
                        • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                          "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:1580
                          • C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\setup_install.exe
                            "C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\setup_install.exe"
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of WriteProcessMemory
                            PID:2096
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c karotima_1.exe
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2260
                              • C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\karotima_1.exe
                                karotima_1.exe
                                5⤵
                                • Executes dropped EXE
                                • Checks computer location settings
                                • Suspicious use of WriteProcessMemory
                                PID:3492
                                • C:\Users\Admin\Documents\mxrfaO5U12e52V8yWfLJNzP5.exe
                                  "C:\Users\Admin\Documents\mxrfaO5U12e52V8yWfLJNzP5.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:2224
                                  • C:\Users\Admin\Documents\mxrfaO5U12e52V8yWfLJNzP5.exe
                                    C:\Users\Admin\Documents\mxrfaO5U12e52V8yWfLJNzP5.exe
                                    7⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1728
                                • C:\Users\Admin\Documents\IZHobLxiAFtyYXT3QirtCdlD.exe
                                  "C:\Users\Admin\Documents\IZHobLxiAFtyYXT3QirtCdlD.exe"
                                  6⤵
                                    PID:1348
                                    • C:\Users\Admin\Documents\IZHobLxiAFtyYXT3QirtCdlD.exe
                                      C:\Users\Admin\Documents\IZHobLxiAFtyYXT3QirtCdlD.exe
                                      7⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3116
                                  • C:\Users\Admin\Documents\CLoUrSF0HOHKnT2JAIXB60kG.exe
                                    "C:\Users\Admin\Documents\CLoUrSF0HOHKnT2JAIXB60kG.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Checks BIOS information in registry
                                    • Checks whether UAC is enabled
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4220
                                  • C:\Users\Admin\Documents\Oot5e51vTQiIWKJ0SwByDd8b.exe
                                    "C:\Users\Admin\Documents\Oot5e51vTQiIWKJ0SwByDd8b.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Checks BIOS information in registry
                                    • Checks whether UAC is enabled
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4212
                                  • C:\Users\Admin\Documents\jiH5URDFJZtgxg96jY3Aioml.exe
                                    "C:\Users\Admin\Documents\jiH5URDFJZtgxg96jY3Aioml.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    PID:4196
                                    • C:\Users\Admin\Documents\jiH5URDFJZtgxg96jY3Aioml.exe
                                      "C:\Users\Admin\Documents\jiH5URDFJZtgxg96jY3Aioml.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      PID:3112
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 776
                                      7⤵
                                      • Program crash
                                      PID:6064
                                  • C:\Users\Admin\Documents\FFhsE8x79xc5MegenSk6bzRx.exe
                                    "C:\Users\Admin\Documents\FFhsE8x79xc5MegenSk6bzRx.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:4184
                                    • C:\Users\Admin\Documents\FFhsE8x79xc5MegenSk6bzRx.exe
                                      C:\Users\Admin\Documents\FFhsE8x79xc5MegenSk6bzRx.exe
                                      7⤵
                                      • Executes dropped EXE
                                      PID:4868
                                    • C:\Users\Admin\Documents\FFhsE8x79xc5MegenSk6bzRx.exe
                                      C:\Users\Admin\Documents\FFhsE8x79xc5MegenSk6bzRx.exe
                                      7⤵
                                      • Executes dropped EXE
                                      PID:3816
                                  • C:\Users\Admin\Documents\CyqonCQFfMxgIvxIaxqT3SpU.exe
                                    "C:\Users\Admin\Documents\CyqonCQFfMxgIvxIaxqT3SpU.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4164
                                  • C:\Users\Admin\Documents\3DzZsbr6RmPPVVIIsj1vqfiy.exe
                                    "C:\Users\Admin\Documents\3DzZsbr6RmPPVVIIsj1vqfiy.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4124
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /c taskkill /f /im chrome.exe
                                      7⤵
                                        PID:1436
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /f /im chrome.exe
                                          8⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • Kills process with taskkill
                                          PID:2128
                                    • C:\Users\Admin\Documents\HOsXrDzkx4Sp6q3oWrWgl1T5.exe
                                      "C:\Users\Admin\Documents\HOsXrDzkx4Sp6q3oWrWgl1T5.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      PID:4116
                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        7⤵
                                        • Executes dropped EXE
                                        PID:1784
                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        7⤵
                                        • Executes dropped EXE
                                        PID:1356
                                      • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        7⤵
                                        • Executes dropped EXE
                                        PID:5704
                                      • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                        7⤵
                                        • Executes dropped EXE
                                        PID:5272
                                    • C:\Users\Admin\Documents\whHJbxfH9AWgXkofhYfT9UWV.exe
                                      "C:\Users\Admin\Documents\whHJbxfH9AWgXkofhYfT9UWV.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:4108
                                      • C:\Users\Admin\Documents\whHJbxfH9AWgXkofhYfT9UWV.exe
                                        C:\Users\Admin\Documents\whHJbxfH9AWgXkofhYfT9UWV.exe
                                        7⤵
                                        • Executes dropped EXE
                                        PID:1504
                                      • C:\Users\Admin\Documents\whHJbxfH9AWgXkofhYfT9UWV.exe
                                        C:\Users\Admin\Documents\whHJbxfH9AWgXkofhYfT9UWV.exe
                                        7⤵
                                        • Executes dropped EXE
                                        PID:4976
                                    • C:\Users\Admin\Documents\2xcJ9bfrJbBLLc_PH9yar5ny.exe
                                      "C:\Users\Admin\Documents\2xcJ9bfrJbBLLc_PH9yar5ny.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:4100
                                      • C:\Users\Admin\Documents\2xcJ9bfrJbBLLc_PH9yar5ny.exe
                                        C:\Users\Admin\Documents\2xcJ9bfrJbBLLc_PH9yar5ny.exe
                                        7⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:2096
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\2xcJ9bfrJbBLLc_PH9yar5ny.exe"
                                          8⤵
                                            PID:5952
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout /T 10 /NOBREAK
                                              9⤵
                                              • Delays execution with timeout.exe
                                              PID:6072
                                      • C:\Users\Admin\Documents\vyY61MrbMtVFXXZkqCfTIZIx.exe
                                        "C:\Users\Admin\Documents\vyY61MrbMtVFXXZkqCfTIZIx.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:2180
                                        • C:\Users\Admin\Documents\vyY61MrbMtVFXXZkqCfTIZIx.exe
                                          C:\Users\Admin\Documents\vyY61MrbMtVFXXZkqCfTIZIx.exe
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Checks processor information in registry
                                          PID:2260
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c taskkill /im vyY61MrbMtVFXXZkqCfTIZIx.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\vyY61MrbMtVFXXZkqCfTIZIx.exe" & del C:\ProgramData\*.dll & exit
                                            8⤵
                                              PID:5440
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /im vyY61MrbMtVFXXZkqCfTIZIx.exe /f
                                                9⤵
                                                • Kills process with taskkill
                                                PID:5680
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout /t 6
                                                9⤵
                                                • Delays execution with timeout.exe
                                                PID:4720
                                          • C:\Users\Admin\Documents\vyY61MrbMtVFXXZkqCfTIZIx.exe
                                            C:\Users\Admin\Documents\vyY61MrbMtVFXXZkqCfTIZIx.exe
                                            7⤵
                                            • Executes dropped EXE
                                            PID:4764
                                          • C:\Users\Admin\Documents\vyY61MrbMtVFXXZkqCfTIZIx.exe
                                            C:\Users\Admin\Documents\vyY61MrbMtVFXXZkqCfTIZIx.exe
                                            7⤵
                                              PID:4112
                                            • C:\Users\Admin\Documents\vyY61MrbMtVFXXZkqCfTIZIx.exe
                                              C:\Users\Admin\Documents\vyY61MrbMtVFXXZkqCfTIZIx.exe
                                              7⤵
                                              • Executes dropped EXE
                                              PID:2444
                                          • C:\Users\Admin\Documents\eZ21RgLKiclIqTHGcUnrlpU7.exe
                                            "C:\Users\Admin\Documents\eZ21RgLKiclIqTHGcUnrlpU7.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            PID:1796
                                            • C:\Users\Admin\Documents\eZ21RgLKiclIqTHGcUnrlpU7.exe
                                              C:\Users\Admin\Documents\eZ21RgLKiclIqTHGcUnrlpU7.exe
                                              7⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Checks processor information in registry
                                              PID:1680
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c taskkill /im eZ21RgLKiclIqTHGcUnrlpU7.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\eZ21RgLKiclIqTHGcUnrlpU7.exe" & del C:\ProgramData\*.dll & exit
                                                8⤵
                                                  PID:5536
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /im eZ21RgLKiclIqTHGcUnrlpU7.exe /f
                                                    9⤵
                                                    • Kills process with taskkill
                                                    PID:5792
                                                  • C:\Windows\SysWOW64\timeout.exe
                                                    timeout /t 6
                                                    9⤵
                                                    • Delays execution with timeout.exe
                                                    PID:1316
                                            • C:\Users\Admin\Documents\UMbqPZeMsAsN2gEhdHbo0pcX.exe
                                              "C:\Users\Admin\Documents\UMbqPZeMsAsN2gEhdHbo0pcX.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              PID:1972
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c cmd < Pura.vssm
                                                7⤵
                                                  PID:3700
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd
                                                    8⤵
                                                      PID:4984
                                                      • C:\Windows\SysWOW64\findstr.exe
                                                        findstr /V /R "^mDHHnooFzwuKWdLxXAvOmqexElRneQaCvwawdMkcQdyHAkGxAHZauWenBjehsKCCIDhUYKrkfwXoVxUaEvXxRZvAZTAtJXtuNCYXYLvQENryYTDusKJU$" Cancellata.vssm
                                                        9⤵
                                                          PID:1340
                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com
                                                          Bordatino.exe.com s
                                                          9⤵
                                                          • Executes dropped EXE
                                                          PID:2232
                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com
                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com s
                                                            10⤵
                                                            • Executes dropped EXE
                                                            • Drops startup file
                                                            PID:5168
                                                        • C:\Windows\SysWOW64\PING.EXE
                                                          ping 127.0.0.1 -n 30
                                                          9⤵
                                                          • Runs ping.exe
                                                          PID:4832
                                                  • C:\Users\Admin\Documents\trYs5gEaVR66PTE_aJd2gRIX.exe
                                                    "C:\Users\Admin\Documents\trYs5gEaVR66PTE_aJd2gRIX.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    PID:2424
                                                    • C:\Users\Admin\Documents\trYs5gEaVR66PTE_aJd2gRIX.exe
                                                      C:\Users\Admin\Documents\trYs5gEaVR66PTE_aJd2gRIX.exe
                                                      7⤵
                                                      • Executes dropped EXE
                                                      PID:2296
                                                    • C:\Users\Admin\Documents\trYs5gEaVR66PTE_aJd2gRIX.exe
                                                      C:\Users\Admin\Documents\trYs5gEaVR66PTE_aJd2gRIX.exe
                                                      7⤵
                                                      • Executes dropped EXE
                                                      PID:4572
                                                  • C:\Users\Admin\Documents\e5xiVKQx9R6rZnSqlRsfwNKZ.exe
                                                    "C:\Users\Admin\Documents\e5xiVKQx9R6rZnSqlRsfwNKZ.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    PID:1800
                                                    • C:\Users\Admin\Documents\e5xiVKQx9R6rZnSqlRsfwNKZ.exe
                                                      "C:\Users\Admin\Documents\e5xiVKQx9R6rZnSqlRsfwNKZ.exe"
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Checks SCSI registry key(s)
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious behavior: MapViewOfSection
                                                      PID:3428
                                                  • C:\Users\Admin\Documents\1anSR6oAbd8z7MS5SNsgWJis.exe
                                                    "C:\Users\Admin\Documents\1anSR6oAbd8z7MS5SNsgWJis.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    PID:2084
                                                  • C:\Users\Admin\Documents\M3AHQan32OUGG8U5z_mKZbPr.exe
                                                    "C:\Users\Admin\Documents\M3AHQan32OUGG8U5z_mKZbPr.exe"
                                                    6⤵
                                                      PID:2128
                                                      • C:\Users\Admin\Documents\M3AHQan32OUGG8U5z_mKZbPr.exe
                                                        C:\Users\Admin\Documents\M3AHQan32OUGG8U5z_mKZbPr.exe
                                                        7⤵
                                                        • Executes dropped EXE
                                                        PID:4788
                                                      • C:\Users\Admin\Documents\M3AHQan32OUGG8U5z_mKZbPr.exe
                                                        C:\Users\Admin\Documents\M3AHQan32OUGG8U5z_mKZbPr.exe
                                                        7⤵
                                                        • Executes dropped EXE
                                                        PID:1144
                                                    • C:\Users\Admin\Documents\QQqVbZP52yY2p3QwuMVWP15l.exe
                                                      "C:\Users\Admin\Documents\QQqVbZP52yY2p3QwuMVWP15l.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      PID:4524
                                                      • C:\Users\Admin\Documents\QQqVbZP52yY2p3QwuMVWP15l.exe
                                                        "C:\Users\Admin\Documents\QQqVbZP52yY2p3QwuMVWP15l.exe"
                                                        7⤵
                                                        • Executes dropped EXE
                                                        • Checks processor information in registry
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:3920
                                                    • C:\Users\Admin\Documents\I6SwM36XDbUXsCHgUstM_CVV.exe
                                                      "C:\Users\Admin\Documents\I6SwM36XDbUXsCHgUstM_CVV.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Checks BIOS information in registry
                                                      • Checks whether UAC is enabled
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4496
                                                    • C:\Users\Admin\Documents\byxO_OvhHhijzRf7l88tf8LH.exe
                                                      "C:\Users\Admin\Documents\byxO_OvhHhijzRf7l88tf8LH.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      PID:4484
                                                      • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                        "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                        7⤵
                                                        • Executes dropped EXE
                                                        PID:5080
                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                          8⤵
                                                          • Executes dropped EXE
                                                          PID:4336
                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                          8⤵
                                                          • Executes dropped EXE
                                                          PID:4088
                                                      • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                        7⤵
                                                        • Executes dropped EXE
                                                        PID:5116
                                                      • C:\Program Files (x86)\Company\NewProduct\customer3.exe
                                                        "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
                                                        7⤵
                                                        • Executes dropped EXE
                                                        PID:4132
                                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                          8⤵
                                                          • Executes dropped EXE
                                                          PID:4528
                                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                          8⤵
                                                          • Executes dropped EXE
                                                          PID:4112
                                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                          8⤵
                                                          • Executes dropped EXE
                                                          PID:5744
                                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                          8⤵
                                                          • Executes dropped EXE
                                                          PID:5304
                                                    • C:\Users\Admin\Documents\Qhh8hvFgecXXFoG3KVOl7s1F.exe
                                                      "C:\Users\Admin\Documents\Qhh8hvFgecXXFoG3KVOl7s1F.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      PID:4476
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 660
                                                        7⤵
                                                        • Program crash
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5052
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 676
                                                        7⤵
                                                        • Program crash
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3960
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 680
                                                        7⤵
                                                        • Program crash
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4756
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 684
                                                        7⤵
                                                        • Program crash
                                                        PID:4260
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 856
                                                        7⤵
                                                        • Program crash
                                                        PID:1788
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 1080
                                                        7⤵
                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • Program crash
                                                        PID:1348
                                                    • C:\Users\Admin\Documents\W71pS1msPE2pFJbuRCecxMYG.exe
                                                      "C:\Users\Admin\Documents\W71pS1msPE2pFJbuRCecxMYG.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Checks processor information in registry
                                                      • Modifies system certificate store
                                                      PID:4252
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im W71pS1msPE2pFJbuRCecxMYG.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\W71pS1msPE2pFJbuRCecxMYG.exe" & del C:\ProgramData\*.dll & exit
                                                        7⤵
                                                          PID:4856
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /im W71pS1msPE2pFJbuRCecxMYG.exe /f
                                                            8⤵
                                                            • Kills process with taskkill
                                                            PID:5220
                                                          • C:\Windows\SysWOW64\timeout.exe
                                                            timeout /t 6
                                                            8⤵
                                                            • Delays execution with timeout.exe
                                                            PID:5784
                                                      • C:\Users\Admin\Documents\_g2czD4kowK7lzvJYfm37VZu.exe
                                                        "C:\Users\Admin\Documents\_g2czD4kowK7lzvJYfm37VZu.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        PID:5008
                                                        • C:\Users\Admin\Documents\_g2czD4kowK7lzvJYfm37VZu.exe
                                                          "C:\Users\Admin\Documents\_g2czD4kowK7lzvJYfm37VZu.exe" -a
                                                          7⤵
                                                            PID:5048
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c karotima_2.exe
                                                      4⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1468
                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\karotima_2.exe
                                                        karotima_2.exe
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:372
                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\karotima_2.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\karotima_2.exe" -a
                                                          6⤵
                                                          • Executes dropped EXE
                                                          PID:1340
                                              • \??\c:\windows\system32\svchost.exe
                                                c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                1⤵
                                                • Suspicious use of SetThreadContext
                                                • Modifies data under HKEY_USERS
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:3948
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                  2⤵
                                                  • Drops file in System32 directory
                                                  • Checks processor information in registry
                                                  • Modifies data under HKEY_USERS
                                                  • Modifies registry class
                                                  PID:2588
                                              • C:\Windows\system32\rUNdlL32.eXe
                                                rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                1⤵
                                                • Process spawned unexpected child process
                                                • Suspicious use of WriteProcessMemory
                                                PID:1796
                                                • C:\Windows\SysWOW64\rundll32.exe
                                                  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                  2⤵
                                                  • Loads dropped DLL
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2740
                                              • C:\Windows\system32\rUNdlL32.eXe
                                                rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                1⤵
                                                • Process spawned unexpected child process
                                                PID:4688
                                                • C:\Windows\SysWOW64\rundll32.exe
                                                  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                  2⤵
                                                  • Loads dropped DLL
                                                  • Modifies registry class
                                                  PID:744
                                              • \??\c:\windows\system32\svchost.exe
                                                c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                1⤵
                                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                PID:5880
                                              • C:\Users\Admin\AppData\Local\Temp\E550.exe
                                                C:\Users\Admin\AppData\Local\Temp\E550.exe
                                                1⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:5048
                                              • C:\Users\Admin\AppData\Local\Temp\E8AC.exe
                                                C:\Users\Admin\AppData\Local\Temp\E8AC.exe
                                                1⤵
                                                • Suspicious use of SetThreadContext
                                                PID:5348
                                                • C:\Users\Admin\AppData\Local\Temp\E8AC.exe
                                                  C:\Users\Admin\AppData\Local\Temp\E8AC.exe
                                                  2⤵
                                                    PID:4384
                                                • C:\Users\Admin\AppData\Local\Temp\EBDA.exe
                                                  C:\Users\Admin\AppData\Local\Temp\EBDA.exe
                                                  1⤵
                                                  • Loads dropped DLL
                                                  PID:5292
                                                • C:\Users\Admin\AppData\Local\Temp\F07E.exe
                                                  C:\Users\Admin\AppData\Local\Temp\F07E.exe
                                                  1⤵
                                                    PID:4548
                                                    • C:\Users\Admin\AppData\Local\Temp\F07E.exe
                                                      C:\Users\Admin\AppData\Local\Temp\F07E.exe
                                                      2⤵
                                                        PID:4960
                                                    • C:\Users\Admin\AppData\Local\Temp\F746.exe
                                                      C:\Users\Admin\AppData\Local\Temp\F746.exe
                                                      1⤵
                                                        PID:4524
                                                      • C:\Users\Admin\AppData\Local\Temp\F93B.exe
                                                        C:\Users\Admin\AppData\Local\Temp\F93B.exe
                                                        1⤵
                                                          PID:5528
                                                          • C:\Users\Admin\AppData\Local\Temp\F93B.exe
                                                            C:\Users\Admin\AppData\Local\Temp\F93B.exe
                                                            2⤵
                                                              PID:4892
                                                          • C:\Users\Admin\AppData\Local\Temp\12.exe
                                                            C:\Users\Admin\AppData\Local\Temp\12.exe
                                                            1⤵
                                                              PID:3848
                                                              • C:\Users\Admin\AppData\Local\Temp\12.exe
                                                                C:\Users\Admin\AppData\Local\Temp\12.exe
                                                                2⤵
                                                                  PID:6084
                                                              • C:\Users\Admin\AppData\Local\Temp\13B.exe
                                                                C:\Users\Admin\AppData\Local\Temp\13B.exe
                                                                1⤵
                                                                  PID:5708
                                                                  • C:\Users\Admin\AppData\Local\Temp\13B.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\13B.exe
                                                                    2⤵
                                                                      PID:5004
                                                                  • C:\Users\Admin\AppData\Local\Temp\350.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\350.exe
                                                                    1⤵
                                                                      PID:5948
                                                                    • C:\Users\Admin\AppData\Local\Temp\600.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\600.exe
                                                                      1⤵
                                                                        PID:4420
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c cmd < Ama.sldx
                                                                          2⤵
                                                                            PID:5816
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd
                                                                              3⤵
                                                                                PID:4340
                                                                                • C:\Windows\SysWOW64\findstr.exe
                                                                                  findstr /V /R "^WyumGSfHLEZtFxRtGySXzLBeKZKbrUOBWpbUBSAhtrnDZbeXuyKTlLllEtPHoSEQQnicWWDNEFSfhYejXNdYlVskZjdbrTyjmHMBdGqpCWgESVWGwCJxBGGU$" Siate.sldx
                                                                                  4⤵
                                                                                    PID:2160
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Pensato.exe.com
                                                                                    Pensato.exe.com L
                                                                                    4⤵
                                                                                      PID:4492
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Pensato.exe.com
                                                                                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Pensato.exe.com L
                                                                                        5⤵
                                                                                          PID:5380
                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                        ping 127.0.0.1 -n 30
                                                                                        4⤵
                                                                                        • Runs ping.exe
                                                                                        PID:3572
                                                                                • C:\Users\Admin\AppData\Local\Temp\7B7.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\7B7.exe
                                                                                  1⤵
                                                                                    PID:5404
                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -start
                                                                                      2⤵
                                                                                        PID:5256
                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 0
                                                                                          3⤵
                                                                                            PID:5656
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
                                                                                            3⤵
                                                                                              PID:6060
                                                                                              • C:\Windows\SysWOW64\vssadmin.exe
                                                                                                vssadmin delete shadows /all /quiet
                                                                                                4⤵
                                                                                                • Interacts with shadow copies
                                                                                                PID:5500
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
                                                                                              3⤵
                                                                                                PID:4284
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                                                                3⤵
                                                                                                  PID:6028
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
                                                                                                  3⤵
                                                                                                    PID:4432
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
                                                                                                    3⤵
                                                                                                      PID:5784
                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                        wmic shadowcopy delete
                                                                                                        4⤵
                                                                                                          PID:3564
                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                    C:\Windows\SysWOW64\explorer.exe
                                                                                                    1⤵
                                                                                                      PID:5784
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      C:\Windows\explorer.exe
                                                                                                      1⤵
                                                                                                      • Drops file in Program Files directory
                                                                                                      PID:5116
                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                                      1⤵
                                                                                                        PID:5536
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        C:\Windows\explorer.exe
                                                                                                        1⤵
                                                                                                          PID:4396
                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                                          1⤵
                                                                                                            PID:2420
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            C:\Windows\explorer.exe
                                                                                                            1⤵
                                                                                                              PID:2500
                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                              C:\Windows\SysWOW64\explorer.exe
                                                                                                              1⤵
                                                                                                                PID:6092
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                C:\Windows\explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:4532
                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                  C:\Windows\SysWOW64\explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:4876
                                                                                                                  • C:\Windows\system32\vssvc.exe
                                                                                                                    C:\Windows\system32\vssvc.exe
                                                                                                                    1⤵
                                                                                                                      PID:6080

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                    Persistence

                                                                                                                    Modify Existing Service

                                                                                                                    1
                                                                                                                    T1031

                                                                                                                    Defense Evasion

                                                                                                                    Modify Registry

                                                                                                                    2
                                                                                                                    T1112

                                                                                                                    Disabling Security Tools

                                                                                                                    1
                                                                                                                    T1089

                                                                                                                    File Deletion

                                                                                                                    2
                                                                                                                    T1107

                                                                                                                    Virtualization/Sandbox Evasion

                                                                                                                    1
                                                                                                                    T1497

                                                                                                                    Install Root Certificate

                                                                                                                    1
                                                                                                                    T1130

                                                                                                                    Credential Access

                                                                                                                    Credentials in Files

                                                                                                                    5
                                                                                                                    T1081

                                                                                                                    Discovery

                                                                                                                    Query Registry

                                                                                                                    6
                                                                                                                    T1012

                                                                                                                    Virtualization/Sandbox Evasion

                                                                                                                    1
                                                                                                                    T1497

                                                                                                                    System Information Discovery

                                                                                                                    6
                                                                                                                    T1082

                                                                                                                    Peripheral Device Discovery

                                                                                                                    1
                                                                                                                    T1120

                                                                                                                    Remote System Discovery

                                                                                                                    1
                                                                                                                    T1018

                                                                                                                    Collection

                                                                                                                    Data from Local System

                                                                                                                    5
                                                                                                                    T1005

                                                                                                                    Command and Control

                                                                                                                    Web Service

                                                                                                                    1
                                                                                                                    T1102

                                                                                                                    Impact

                                                                                                                    Inhibit System Recovery

                                                                                                                    2
                                                                                                                    T1490

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\karotima_1.exe
                                                                                                                      MD5

                                                                                                                      4a1a271c67b98c9cfc4c6efa7411b1dd

                                                                                                                      SHA1

                                                                                                                      e2325cb6f55d5fea29ce0d31cad487f2b4e6f891

                                                                                                                      SHA256

                                                                                                                      3c33e130ffc0a583909982f29c38bffb518ae0fd0ef7397855906beef3cd993d

                                                                                                                      SHA512

                                                                                                                      e9fc716c03a5f8a327ac1e68336ed0901864b9629dcfd0a32efe406cdfc571c1bd01012aa373d2ad993d9ae4820044963a1f4cd2ba7ebe5a4b53b143b7b7a2c2

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\karotima_1.txt
                                                                                                                      MD5

                                                                                                                      4a1a271c67b98c9cfc4c6efa7411b1dd

                                                                                                                      SHA1

                                                                                                                      e2325cb6f55d5fea29ce0d31cad487f2b4e6f891

                                                                                                                      SHA256

                                                                                                                      3c33e130ffc0a583909982f29c38bffb518ae0fd0ef7397855906beef3cd993d

                                                                                                                      SHA512

                                                                                                                      e9fc716c03a5f8a327ac1e68336ed0901864b9629dcfd0a32efe406cdfc571c1bd01012aa373d2ad993d9ae4820044963a1f4cd2ba7ebe5a4b53b143b7b7a2c2

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\karotima_2.exe
                                                                                                                      MD5

                                                                                                                      8da953a71f7d9811e648b7644f39c445

                                                                                                                      SHA1

                                                                                                                      c39fd05d024249bc8d63493026474e797fd1eeaf

                                                                                                                      SHA256

                                                                                                                      ac6143d8ef00d3008388f0c4606bbcf9672eddde1cf76ad102ffb2db26fa6e71

                                                                                                                      SHA512

                                                                                                                      d75c871c781344968676a2c47e8c2387624d9f9aef7652b7eb97a2aebf9d474fcfe8a6f811b79a76fa4be980ccdfa8646b911e40827324800e233d390f1bcad3

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\karotima_2.exe
                                                                                                                      MD5

                                                                                                                      8da953a71f7d9811e648b7644f39c445

                                                                                                                      SHA1

                                                                                                                      c39fd05d024249bc8d63493026474e797fd1eeaf

                                                                                                                      SHA256

                                                                                                                      ac6143d8ef00d3008388f0c4606bbcf9672eddde1cf76ad102ffb2db26fa6e71

                                                                                                                      SHA512

                                                                                                                      d75c871c781344968676a2c47e8c2387624d9f9aef7652b7eb97a2aebf9d474fcfe8a6f811b79a76fa4be980ccdfa8646b911e40827324800e233d390f1bcad3

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\karotima_2.txt
                                                                                                                      MD5

                                                                                                                      8da953a71f7d9811e648b7644f39c445

                                                                                                                      SHA1

                                                                                                                      c39fd05d024249bc8d63493026474e797fd1eeaf

                                                                                                                      SHA256

                                                                                                                      ac6143d8ef00d3008388f0c4606bbcf9672eddde1cf76ad102ffb2db26fa6e71

                                                                                                                      SHA512

                                                                                                                      d75c871c781344968676a2c47e8c2387624d9f9aef7652b7eb97a2aebf9d474fcfe8a6f811b79a76fa4be980ccdfa8646b911e40827324800e233d390f1bcad3

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\libcurl.dll
                                                                                                                      MD5

                                                                                                                      d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                      SHA1

                                                                                                                      028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                      SHA256

                                                                                                                      0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                      SHA512

                                                                                                                      857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\libcurlpp.dll
                                                                                                                      MD5

                                                                                                                      e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                      SHA1

                                                                                                                      b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                      SHA256

                                                                                                                      43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                      SHA512

                                                                                                                      9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\libgcc_s_dw2-1.dll
                                                                                                                      MD5

                                                                                                                      9aec524b616618b0d3d00b27b6f51da1

                                                                                                                      SHA1

                                                                                                                      64264300801a353db324d11738ffed876550e1d3

                                                                                                                      SHA256

                                                                                                                      59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                      SHA512

                                                                                                                      0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\libstdc++-6.dll
                                                                                                                      MD5

                                                                                                                      5e279950775baae5fea04d2cc4526bcc

                                                                                                                      SHA1

                                                                                                                      8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                      SHA256

                                                                                                                      97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                      SHA512

                                                                                                                      666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\libwinpthread-1.dll
                                                                                                                      MD5

                                                                                                                      1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                      SHA1

                                                                                                                      fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                      SHA256

                                                                                                                      509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                      SHA512

                                                                                                                      3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\setup_install.exe
                                                                                                                      MD5

                                                                                                                      ff889f894a6e808e00b3ed0d178ed433

                                                                                                                      SHA1

                                                                                                                      7bcfb1f8078366c8967fb76866c2766092b4ca96

                                                                                                                      SHA256

                                                                                                                      639be87c55011c11c22e3fb2abb9a569e85e46981957194bdd466068d81ec9d2

                                                                                                                      SHA512

                                                                                                                      077aab6a4abbf1be970f137872bf1af8f28681a4dfd79a9cfca4b6bef46e20ae78b39e5cb6b1c71890c4ee8599740f0b6de88888425e175c826d99a65131c03c

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC260ED34\setup_install.exe
                                                                                                                      MD5

                                                                                                                      ff889f894a6e808e00b3ed0d178ed433

                                                                                                                      SHA1

                                                                                                                      7bcfb1f8078366c8967fb76866c2766092b4ca96

                                                                                                                      SHA256

                                                                                                                      639be87c55011c11c22e3fb2abb9a569e85e46981957194bdd466068d81ec9d2

                                                                                                                      SHA512

                                                                                                                      077aab6a4abbf1be970f137872bf1af8f28681a4dfd79a9cfca4b6bef46e20ae78b39e5cb6b1c71890c4ee8599740f0b6de88888425e175c826d99a65131c03c

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\axhub.dat
                                                                                                                      MD5

                                                                                                                      c5c411ddf0d0dd87bc6fdb84975fc292

                                                                                                                      SHA1

                                                                                                                      e04d41c06a12d46c5ba8220509d89d2a66140892

                                                                                                                      SHA256

                                                                                                                      dc16f2dadacfad74d074a70c060bafc95d49a7d08a1cbe24f35ddb1769fb56da

                                                                                                                      SHA512

                                                                                                                      9ed2af8bef3a1873efefb048c3e2733e994bf6300bdfb06ea12939450e65abfa19b4753a1e0755a755a8aed10398982c737d33b9fa79f91ffa356ef4ce20109b

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\axhub.dll
                                                                                                                      MD5

                                                                                                                      1c7be730bdc4833afb7117d48c3fd513

                                                                                                                      SHA1

                                                                                                                      dc7e38cfe2ae4a117922306aead5a7544af646b8

                                                                                                                      SHA256

                                                                                                                      8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

                                                                                                                      SHA512

                                                                                                                      7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                      MD5

                                                                                                                      ff174aceeaaecd10d1c987f575fa1985

                                                                                                                      SHA1

                                                                                                                      393b5a1d6dcd147f0801d7c7ac11100971ed5879

                                                                                                                      SHA256

                                                                                                                      86dbd4db3c5fd0bd2d56e3469eb7c1f7d022cf5b362b6fbb198d939a051a4b17

                                                                                                                      SHA512

                                                                                                                      f030028afa97c05a18ad9ac0db381aa5d9f1645c29f4536cff747f2d46dcc0ec9c4037750c0ad3bc25e32d1cdc06c84288839b3fc2ebf0f5082607dab6bc396c

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                      MD5

                                                                                                                      ff174aceeaaecd10d1c987f575fa1985

                                                                                                                      SHA1

                                                                                                                      393b5a1d6dcd147f0801d7c7ac11100971ed5879

                                                                                                                      SHA256

                                                                                                                      86dbd4db3c5fd0bd2d56e3469eb7c1f7d022cf5b362b6fbb198d939a051a4b17

                                                                                                                      SHA512

                                                                                                                      f030028afa97c05a18ad9ac0db381aa5d9f1645c29f4536cff747f2d46dcc0ec9c4037750c0ad3bc25e32d1cdc06c84288839b3fc2ebf0f5082607dab6bc396c

                                                                                                                    • C:\Users\Admin\Documents\1anSR6oAbd8z7MS5SNsgWJis.exe
                                                                                                                      MD5

                                                                                                                      00382cb5b5964c5a95c0cf56cc4ce04b

                                                                                                                      SHA1

                                                                                                                      57055b12e1d1180fd7bfd7fda5b2d1b4801e527e

                                                                                                                      SHA256

                                                                                                                      35f7ad295f00b38a569f136204a7b1a9dbfdc17760c6999c456df20fe96e28e2

                                                                                                                      SHA512

                                                                                                                      50fea530a9bea9c1576c184356026a32d2861c0ef557367cc9138eb7e3baaceacdc7e01031051ca33861cc2c59f899ca912a43757a9fc0ab687384d82c7d8af6

                                                                                                                    • C:\Users\Admin\Documents\1anSR6oAbd8z7MS5SNsgWJis.exe
                                                                                                                      MD5

                                                                                                                      00382cb5b5964c5a95c0cf56cc4ce04b

                                                                                                                      SHA1

                                                                                                                      57055b12e1d1180fd7bfd7fda5b2d1b4801e527e

                                                                                                                      SHA256

                                                                                                                      35f7ad295f00b38a569f136204a7b1a9dbfdc17760c6999c456df20fe96e28e2

                                                                                                                      SHA512

                                                                                                                      50fea530a9bea9c1576c184356026a32d2861c0ef557367cc9138eb7e3baaceacdc7e01031051ca33861cc2c59f899ca912a43757a9fc0ab687384d82c7d8af6

                                                                                                                    • C:\Users\Admin\Documents\2xcJ9bfrJbBLLc_PH9yar5ny.exe
                                                                                                                      MD5

                                                                                                                      3fc3cda9f2e33072e179ac256b3de820

                                                                                                                      SHA1

                                                                                                                      c19c6727af6db25f9fe93da4b536a4c8c3daf7d9

                                                                                                                      SHA256

                                                                                                                      54f7ad2fa8de4e86e2a5519ab9b043abe5285911a626b462f90817080f7366e6

                                                                                                                      SHA512

                                                                                                                      fef02b52921caeb378be8fa108dbce8346c5860e615cad5a16bb5332ff1af0a040cebf3d8668ef6a9faac72102fa7d151f0e89e8cea5ae318d25e378baa0383d

                                                                                                                    • C:\Users\Admin\Documents\2xcJ9bfrJbBLLc_PH9yar5ny.exe
                                                                                                                      MD5

                                                                                                                      3fc3cda9f2e33072e179ac256b3de820

                                                                                                                      SHA1

                                                                                                                      c19c6727af6db25f9fe93da4b536a4c8c3daf7d9

                                                                                                                      SHA256

                                                                                                                      54f7ad2fa8de4e86e2a5519ab9b043abe5285911a626b462f90817080f7366e6

                                                                                                                      SHA512

                                                                                                                      fef02b52921caeb378be8fa108dbce8346c5860e615cad5a16bb5332ff1af0a040cebf3d8668ef6a9faac72102fa7d151f0e89e8cea5ae318d25e378baa0383d

                                                                                                                    • C:\Users\Admin\Documents\3DzZsbr6RmPPVVIIsj1vqfiy.exe
                                                                                                                      MD5

                                                                                                                      e0d2c01e5f90edfe91cfcc90f19dcbc1

                                                                                                                      SHA1

                                                                                                                      4475589e3dd73d4f47cb2e39e57962e4b40990ba

                                                                                                                      SHA256

                                                                                                                      7e7127e604ed970f1f7991b58fd3655bb09dea88fef83305a3bd24e9944e805b

                                                                                                                      SHA512

                                                                                                                      0c22265c285b923bad81205d00598d578b141d5cbf3d387905e355901e3e521945c6c105211c9640e7a3647d405e6df16d317aed1f4579666b7f88a6f8fe09ab

                                                                                                                    • C:\Users\Admin\Documents\3DzZsbr6RmPPVVIIsj1vqfiy.exe
                                                                                                                      MD5

                                                                                                                      e0d2c01e5f90edfe91cfcc90f19dcbc1

                                                                                                                      SHA1

                                                                                                                      4475589e3dd73d4f47cb2e39e57962e4b40990ba

                                                                                                                      SHA256

                                                                                                                      7e7127e604ed970f1f7991b58fd3655bb09dea88fef83305a3bd24e9944e805b

                                                                                                                      SHA512

                                                                                                                      0c22265c285b923bad81205d00598d578b141d5cbf3d387905e355901e3e521945c6c105211c9640e7a3647d405e6df16d317aed1f4579666b7f88a6f8fe09ab

                                                                                                                    • C:\Users\Admin\Documents\CLoUrSF0HOHKnT2JAIXB60kG.exe
                                                                                                                      MD5

                                                                                                                      f495d1bb164fad60bada4c47627010e3

                                                                                                                      SHA1

                                                                                                                      6fcc50883a8f730d76be823efd090a906477fb54

                                                                                                                      SHA256

                                                                                                                      447b072f8b7d1d54e85022d066154864006618a1945fdfaf3f647e219475f874

                                                                                                                      SHA512

                                                                                                                      1c618065c53e8241528908c6ad57f7f935fa6371e9fe11ab205356beec58fd37978628b8eab0609ff66f5a6e288b2aaf0cb25aaf369b12514f3506944e77a859

                                                                                                                    • C:\Users\Admin\Documents\CyqonCQFfMxgIvxIaxqT3SpU.exe
                                                                                                                      MD5

                                                                                                                      3f6b84ccd4292674328ab4754f4a5ba2

                                                                                                                      SHA1

                                                                                                                      74aaf6dde13a3762503188b4e5c5d4f79dd5380a

                                                                                                                      SHA256

                                                                                                                      0fbccc26213ec041b38565416c423bbf000c8ff5fef6f2dd4ca1bcb112bc4794

                                                                                                                      SHA512

                                                                                                                      ff4aeaf69f0b86686a5195a441a2f3c57b660dfb2a04a3427dff00bd330db80e4623b97d6f71f1fdc8e33ed1f52d3ae17ccaf37a1df6110655f0bad7aed828e1

                                                                                                                    • C:\Users\Admin\Documents\CyqonCQFfMxgIvxIaxqT3SpU.exe
                                                                                                                      MD5

                                                                                                                      3f6b84ccd4292674328ab4754f4a5ba2

                                                                                                                      SHA1

                                                                                                                      74aaf6dde13a3762503188b4e5c5d4f79dd5380a

                                                                                                                      SHA256

                                                                                                                      0fbccc26213ec041b38565416c423bbf000c8ff5fef6f2dd4ca1bcb112bc4794

                                                                                                                      SHA512

                                                                                                                      ff4aeaf69f0b86686a5195a441a2f3c57b660dfb2a04a3427dff00bd330db80e4623b97d6f71f1fdc8e33ed1f52d3ae17ccaf37a1df6110655f0bad7aed828e1

                                                                                                                    • C:\Users\Admin\Documents\FFhsE8x79xc5MegenSk6bzRx.exe
                                                                                                                      MD5

                                                                                                                      d2792e1448fdf7a225b51b4688b855c9

                                                                                                                      SHA1

                                                                                                                      5e00613e000595c45914848ef69b820208c19eba

                                                                                                                      SHA256

                                                                                                                      02e9bbebcc372e37d18f0dfed9c2dc5e50a23b7305aa3527accedba48bbd8432

                                                                                                                      SHA512

                                                                                                                      6de5d993a70604c26be7b2ea6b069ee17abf5df412a43bdc9812d7403925d383d12be07c35a712f6dfca79e43ecc362c3135cd8eb27a0ec690ca46394dcb9215

                                                                                                                    • C:\Users\Admin\Documents\FFhsE8x79xc5MegenSk6bzRx.exe
                                                                                                                      MD5

                                                                                                                      d2792e1448fdf7a225b51b4688b855c9

                                                                                                                      SHA1

                                                                                                                      5e00613e000595c45914848ef69b820208c19eba

                                                                                                                      SHA256

                                                                                                                      02e9bbebcc372e37d18f0dfed9c2dc5e50a23b7305aa3527accedba48bbd8432

                                                                                                                      SHA512

                                                                                                                      6de5d993a70604c26be7b2ea6b069ee17abf5df412a43bdc9812d7403925d383d12be07c35a712f6dfca79e43ecc362c3135cd8eb27a0ec690ca46394dcb9215

                                                                                                                    • C:\Users\Admin\Documents\HOsXrDzkx4Sp6q3oWrWgl1T5.exe
                                                                                                                      MD5

                                                                                                                      38bce36f28d65863d45c7aff3e4f6df7

                                                                                                                      SHA1

                                                                                                                      d132febde405e8553f2f886addd6796feb64532a

                                                                                                                      SHA256

                                                                                                                      dc6765f28c007d5c7d351abe710c09d6efdd1c43dafe22dcb1eabc7d44116845

                                                                                                                      SHA512

                                                                                                                      453d395504e8a9a99c110ff4ee5c29544c5770283b6e14b8fb70287c1a47eec6eb19186127f972525c463c36bb1bda27b02d13f712dff2db5f280d57ef7eb198

                                                                                                                    • C:\Users\Admin\Documents\HOsXrDzkx4Sp6q3oWrWgl1T5.exe
                                                                                                                      MD5

                                                                                                                      38bce36f28d65863d45c7aff3e4f6df7

                                                                                                                      SHA1

                                                                                                                      d132febde405e8553f2f886addd6796feb64532a

                                                                                                                      SHA256

                                                                                                                      dc6765f28c007d5c7d351abe710c09d6efdd1c43dafe22dcb1eabc7d44116845

                                                                                                                      SHA512

                                                                                                                      453d395504e8a9a99c110ff4ee5c29544c5770283b6e14b8fb70287c1a47eec6eb19186127f972525c463c36bb1bda27b02d13f712dff2db5f280d57ef7eb198

                                                                                                                    • C:\Users\Admin\Documents\I6SwM36XDbUXsCHgUstM_CVV.exe
                                                                                                                      MD5

                                                                                                                      bd88c191616a8bad408cd0de6a56e751

                                                                                                                      SHA1

                                                                                                                      83eb93225c8b2af40ad32c79a51f5b87cc71dcd2

                                                                                                                      SHA256

                                                                                                                      356b8c6fb618bd0d3addcd935077f0450107f57cdb79641fdb4bd10270ab6064

                                                                                                                      SHA512

                                                                                                                      8750550ec12b966a11a1af1e45508470019ad9ea5910d2f09919dd9c93657887ed8193beec1685879201dffcbd0a55607268eca9821a2f6f669b1f119905d9e4

                                                                                                                    • C:\Users\Admin\Documents\IZHobLxiAFtyYXT3QirtCdlD.exe
                                                                                                                      MD5

                                                                                                                      aad9f8143d6c128c233ac8a574cd1230

                                                                                                                      SHA1

                                                                                                                      bf6f1b7e334ff62fb25a0c9acc22ccfb2e86d755

                                                                                                                      SHA256

                                                                                                                      3b7b5389e0f134d7b0bb6a57a94e8559baa0a45777bf11e344c529064b186962

                                                                                                                      SHA512

                                                                                                                      a226de09af59a1c943e692a1d849984d48c8a0eaf2bc9f350f9fe5ba4ae5bf4afa4b2904faf9391875c27d09f5de054aa014d543671b530939ea704af2db7df9

                                                                                                                    • C:\Users\Admin\Documents\M3AHQan32OUGG8U5z_mKZbPr.exe
                                                                                                                      MD5

                                                                                                                      3242f74bc2e2936de899a749ecff59cf

                                                                                                                      SHA1

                                                                                                                      9176f251c6c4135190315ef9d4a2f25b7a801c56

                                                                                                                      SHA256

                                                                                                                      55aecb45a0e3844c0621c28907e857ec0ab23372e57bfa5dd614ea0b298b2c71

                                                                                                                      SHA512

                                                                                                                      fc7f74b3153a3c798a89fda1efe4809568cd35a7c00a3611275013c0a1ffbbead29e1e67e853875b56e73404c7dcc7c8f4e38296cc560e1086c91f4fcc989927

                                                                                                                    • C:\Users\Admin\Documents\M3AHQan32OUGG8U5z_mKZbPr.exe
                                                                                                                      MD5

                                                                                                                      3242f74bc2e2936de899a749ecff59cf

                                                                                                                      SHA1

                                                                                                                      9176f251c6c4135190315ef9d4a2f25b7a801c56

                                                                                                                      SHA256

                                                                                                                      55aecb45a0e3844c0621c28907e857ec0ab23372e57bfa5dd614ea0b298b2c71

                                                                                                                      SHA512

                                                                                                                      fc7f74b3153a3c798a89fda1efe4809568cd35a7c00a3611275013c0a1ffbbead29e1e67e853875b56e73404c7dcc7c8f4e38296cc560e1086c91f4fcc989927

                                                                                                                    • C:\Users\Admin\Documents\Oot5e51vTQiIWKJ0SwByDd8b.exe
                                                                                                                      MD5

                                                                                                                      c6b962b80fbabd7839fa01abd010dba9

                                                                                                                      SHA1

                                                                                                                      14bc022ba68b8fe9947cfb45c32473f738ea1546

                                                                                                                      SHA256

                                                                                                                      cab81fbf16ca9e47efd63a5ade336d73dcfa12d2efd4a12ec2692a8aa0df9314

                                                                                                                      SHA512

                                                                                                                      eb6af84898bc4d366e859a7fe79714f57b8b3c57485c3a571dac63bf25bfe56cb70719cd25007e7c40bb729c0e685b65890ee986df859ef4521aa4af8c2e2447

                                                                                                                    • C:\Users\Admin\Documents\QQqVbZP52yY2p3QwuMVWP15l.exe
                                                                                                                      MD5

                                                                                                                      c69c54af8218586e28d29ce6a602d956

                                                                                                                      SHA1

                                                                                                                      c9997908a56274b93be4c6416d6c345dbb2fc168

                                                                                                                      SHA256

                                                                                                                      859991c4a6e9b400e5f7057d801cc83eed955573705193c30370a6fb4692ef19

                                                                                                                      SHA512

                                                                                                                      99ab3edc88ead3252ab7e8543e7765ad7c683b661a1697100420ab80e99717d78eae634698e29d7c72e4f58ca18171a3ba97d770541357efef6244bc3b671a13

                                                                                                                    • C:\Users\Admin\Documents\QQqVbZP52yY2p3QwuMVWP15l.exe
                                                                                                                      MD5

                                                                                                                      c69c54af8218586e28d29ce6a602d956

                                                                                                                      SHA1

                                                                                                                      c9997908a56274b93be4c6416d6c345dbb2fc168

                                                                                                                      SHA256

                                                                                                                      859991c4a6e9b400e5f7057d801cc83eed955573705193c30370a6fb4692ef19

                                                                                                                      SHA512

                                                                                                                      99ab3edc88ead3252ab7e8543e7765ad7c683b661a1697100420ab80e99717d78eae634698e29d7c72e4f58ca18171a3ba97d770541357efef6244bc3b671a13

                                                                                                                    • C:\Users\Admin\Documents\Qhh8hvFgecXXFoG3KVOl7s1F.exe
                                                                                                                      MD5

                                                                                                                      53a054b69aa3f6a1a4b49263d682bdde

                                                                                                                      SHA1

                                                                                                                      5b28a3cfdc97b2f06c887e5d8458fff7602ee8ff

                                                                                                                      SHA256

                                                                                                                      e7c5567fd365d83b90ad0ce5dfa783f4f9fe1a9adfa71ebfafcdc318319e8d2a

                                                                                                                      SHA512

                                                                                                                      1a6c731a7a32dcd957a8f98ae06140d0a36419d9bcdeb52dafe8c42da9d3d3e948d74ae53c4e02c16f8619dafb729fc901677846a910303bc26904e9d1adfdf0

                                                                                                                    • C:\Users\Admin\Documents\Qhh8hvFgecXXFoG3KVOl7s1F.exe
                                                                                                                      MD5

                                                                                                                      53a054b69aa3f6a1a4b49263d682bdde

                                                                                                                      SHA1

                                                                                                                      5b28a3cfdc97b2f06c887e5d8458fff7602ee8ff

                                                                                                                      SHA256

                                                                                                                      e7c5567fd365d83b90ad0ce5dfa783f4f9fe1a9adfa71ebfafcdc318319e8d2a

                                                                                                                      SHA512

                                                                                                                      1a6c731a7a32dcd957a8f98ae06140d0a36419d9bcdeb52dafe8c42da9d3d3e948d74ae53c4e02c16f8619dafb729fc901677846a910303bc26904e9d1adfdf0

                                                                                                                    • C:\Users\Admin\Documents\UMbqPZeMsAsN2gEhdHbo0pcX.exe
                                                                                                                      MD5

                                                                                                                      b719cba1a8c6e43a6f106a57b04962e4

                                                                                                                      SHA1

                                                                                                                      80363428f99500ca7da13ad4ff5b07a97627507f

                                                                                                                      SHA256

                                                                                                                      82d440b0f4ab1630e2e2cfe49a04ea383657ef055b33fb86db7aaa8131e2933b

                                                                                                                      SHA512

                                                                                                                      0411ed00195a9bde7710718939af58a8a090d5db924e4317b499ee89dc6f1e83908045e787e36237887df738351de310b1c61da99b8df702f0033b0255935264

                                                                                                                    • C:\Users\Admin\Documents\UMbqPZeMsAsN2gEhdHbo0pcX.exe
                                                                                                                      MD5

                                                                                                                      b719cba1a8c6e43a6f106a57b04962e4

                                                                                                                      SHA1

                                                                                                                      80363428f99500ca7da13ad4ff5b07a97627507f

                                                                                                                      SHA256

                                                                                                                      82d440b0f4ab1630e2e2cfe49a04ea383657ef055b33fb86db7aaa8131e2933b

                                                                                                                      SHA512

                                                                                                                      0411ed00195a9bde7710718939af58a8a090d5db924e4317b499ee89dc6f1e83908045e787e36237887df738351de310b1c61da99b8df702f0033b0255935264

                                                                                                                    • C:\Users\Admin\Documents\W71pS1msPE2pFJbuRCecxMYG.exe
                                                                                                                      MD5

                                                                                                                      ac90690d68ee34e13a1f0ae7e048b738

                                                                                                                      SHA1

                                                                                                                      b114832b27ccd73915581e7d40ad26c5148895e0

                                                                                                                      SHA256

                                                                                                                      6b485669b7caedf1848b4e5dfc21e976ab25f6070db3a743906881af02d7adf1

                                                                                                                      SHA512

                                                                                                                      d8b9ee09880fda6523ad7deb9ac747cd12817395e8d52adfc7643e579b0bcaf727fbef488fa5afc01e042da20595972b0bd6fbb9c22ef9b2fc18d1525d329c1d

                                                                                                                    • C:\Users\Admin\Documents\W71pS1msPE2pFJbuRCecxMYG.exe
                                                                                                                      MD5

                                                                                                                      ac90690d68ee34e13a1f0ae7e048b738

                                                                                                                      SHA1

                                                                                                                      b114832b27ccd73915581e7d40ad26c5148895e0

                                                                                                                      SHA256

                                                                                                                      6b485669b7caedf1848b4e5dfc21e976ab25f6070db3a743906881af02d7adf1

                                                                                                                      SHA512

                                                                                                                      d8b9ee09880fda6523ad7deb9ac747cd12817395e8d52adfc7643e579b0bcaf727fbef488fa5afc01e042da20595972b0bd6fbb9c22ef9b2fc18d1525d329c1d

                                                                                                                    • C:\Users\Admin\Documents\byxO_OvhHhijzRf7l88tf8LH.exe
                                                                                                                      MD5

                                                                                                                      d5a3b0b5e9aefb424b2835b5664b1313

                                                                                                                      SHA1

                                                                                                                      58d054182e4c8c633edf3ed18ca61e05a57f50d6

                                                                                                                      SHA256

                                                                                                                      2cf7ba3d49e634a97536cb0f6a9629d6ab4af9f042f9210e5447dfc2972bfd4a

                                                                                                                      SHA512

                                                                                                                      5dc0c22d63628c9bcb2c319ecfdd0bb94644696bf293235eec734ca9cfc08e52922a011701c5ae95baff76c3e11da957f53dad880c76dbe4249751f68982daaa

                                                                                                                    • C:\Users\Admin\Documents\byxO_OvhHhijzRf7l88tf8LH.exe
                                                                                                                      MD5

                                                                                                                      d5a3b0b5e9aefb424b2835b5664b1313

                                                                                                                      SHA1

                                                                                                                      58d054182e4c8c633edf3ed18ca61e05a57f50d6

                                                                                                                      SHA256

                                                                                                                      2cf7ba3d49e634a97536cb0f6a9629d6ab4af9f042f9210e5447dfc2972bfd4a

                                                                                                                      SHA512

                                                                                                                      5dc0c22d63628c9bcb2c319ecfdd0bb94644696bf293235eec734ca9cfc08e52922a011701c5ae95baff76c3e11da957f53dad880c76dbe4249751f68982daaa

                                                                                                                    • C:\Users\Admin\Documents\e5xiVKQx9R6rZnSqlRsfwNKZ.exe
                                                                                                                      MD5

                                                                                                                      0bd3895d6f986864e1d2ac0b28b12bcb

                                                                                                                      SHA1

                                                                                                                      c1b9a9f3468f337532b1f79ea8ccb193061bb9b3

                                                                                                                      SHA256

                                                                                                                      2e56d9ec07531bf9d7951aecc8a0a9f87076c01ee06fa5cb319f67f5341f8058

                                                                                                                      SHA512

                                                                                                                      bdec4552ed2ea2c8082c8f604dc51c9c428d25653eac9709009a2461adb11f50b7b54968b33c045f08ed6a97539a3693d13634511002d4bcc330c1b366794061

                                                                                                                    • C:\Users\Admin\Documents\e5xiVKQx9R6rZnSqlRsfwNKZ.exe
                                                                                                                      MD5

                                                                                                                      0bd3895d6f986864e1d2ac0b28b12bcb

                                                                                                                      SHA1

                                                                                                                      c1b9a9f3468f337532b1f79ea8ccb193061bb9b3

                                                                                                                      SHA256

                                                                                                                      2e56d9ec07531bf9d7951aecc8a0a9f87076c01ee06fa5cb319f67f5341f8058

                                                                                                                      SHA512

                                                                                                                      bdec4552ed2ea2c8082c8f604dc51c9c428d25653eac9709009a2461adb11f50b7b54968b33c045f08ed6a97539a3693d13634511002d4bcc330c1b366794061

                                                                                                                    • C:\Users\Admin\Documents\eZ21RgLKiclIqTHGcUnrlpU7.exe
                                                                                                                      MD5

                                                                                                                      37bac268d60ba9d17e1667bdece92bed

                                                                                                                      SHA1

                                                                                                                      42533d6cfe1a6a200f8012235008c85ac3b01b33

                                                                                                                      SHA256

                                                                                                                      cd4697de45c6ee220d0c9364a0c93378ac806d9af68abb4811ab326721eaeb84

                                                                                                                      SHA512

                                                                                                                      b82a451255867d048575c79091ca9af5b56a5f67294536ce0ab9770c56a5d17d3ddffe2c8ea7864b5b8644270332f37554413d38bb7fe4976d40fd6a84d03057

                                                                                                                    • C:\Users\Admin\Documents\eZ21RgLKiclIqTHGcUnrlpU7.exe
                                                                                                                      MD5

                                                                                                                      37bac268d60ba9d17e1667bdece92bed

                                                                                                                      SHA1

                                                                                                                      42533d6cfe1a6a200f8012235008c85ac3b01b33

                                                                                                                      SHA256

                                                                                                                      cd4697de45c6ee220d0c9364a0c93378ac806d9af68abb4811ab326721eaeb84

                                                                                                                      SHA512

                                                                                                                      b82a451255867d048575c79091ca9af5b56a5f67294536ce0ab9770c56a5d17d3ddffe2c8ea7864b5b8644270332f37554413d38bb7fe4976d40fd6a84d03057

                                                                                                                    • C:\Users\Admin\Documents\jiH5URDFJZtgxg96jY3Aioml.exe
                                                                                                                      MD5

                                                                                                                      ce08b9bcb1d1a2787a4cc96ec16a777b

                                                                                                                      SHA1

                                                                                                                      d24563451408339690a2df03cbc3264cf1fced60

                                                                                                                      SHA256

                                                                                                                      a86c7bd6eca9eef48dfd38b916d674748986ce058da2a1493e16e2d3e72d1b55

                                                                                                                      SHA512

                                                                                                                      77d233b95af3b7a298809e0c8c352801235cdb677193195e8f962ae3cb6af76acbbe1b907319f8548d1b9b05e4dc3e5c1755dbedcffaadacfd6238f1da246c8b

                                                                                                                    • C:\Users\Admin\Documents\jiH5URDFJZtgxg96jY3Aioml.exe
                                                                                                                      MD5

                                                                                                                      ce08b9bcb1d1a2787a4cc96ec16a777b

                                                                                                                      SHA1

                                                                                                                      d24563451408339690a2df03cbc3264cf1fced60

                                                                                                                      SHA256

                                                                                                                      a86c7bd6eca9eef48dfd38b916d674748986ce058da2a1493e16e2d3e72d1b55

                                                                                                                      SHA512

                                                                                                                      77d233b95af3b7a298809e0c8c352801235cdb677193195e8f962ae3cb6af76acbbe1b907319f8548d1b9b05e4dc3e5c1755dbedcffaadacfd6238f1da246c8b

                                                                                                                    • C:\Users\Admin\Documents\mxrfaO5U12e52V8yWfLJNzP5.exe
                                                                                                                      MD5

                                                                                                                      35cb601362743df19723b17045a4961c

                                                                                                                      SHA1

                                                                                                                      6d6f732d2293a559985282536cc7fa07c6381cda

                                                                                                                      SHA256

                                                                                                                      541d3642089ec4bb9214d30c65244a800750224c7672995d8a5b5d536bec1a6b

                                                                                                                      SHA512

                                                                                                                      b419dcb48171cc5c0da04871df5f1b7de0eb0ad3d25012b80129fa79c3fde72e7aa73a0172c8e08e2503274328f04ee1c58cf54272b3d3551d28ac357b26edb2

                                                                                                                    • C:\Users\Admin\Documents\trYs5gEaVR66PTE_aJd2gRIX.exe
                                                                                                                      MD5

                                                                                                                      6236a3ae4511ab88440de1705143668a

                                                                                                                      SHA1

                                                                                                                      1895f0aadf1b076399f38146402ef7a65c03a09c

                                                                                                                      SHA256

                                                                                                                      1755700dca35f231e22781a85fe5ac3b611c9db2aa79b451224b48ea62945fc6

                                                                                                                      SHA512

                                                                                                                      b7c4c3dd9d8d1e4bf99c5eb5cf49a049e743605fd470b1248dc3da83bad0d3e17124a6845d89ef87f664b70e09eb65348c7c927c89673350adc65d4240695e64

                                                                                                                    • C:\Users\Admin\Documents\vyY61MrbMtVFXXZkqCfTIZIx.exe
                                                                                                                      MD5

                                                                                                                      1200d489e366eee5647b09dc1f024db7

                                                                                                                      SHA1

                                                                                                                      4d0db82bee0608499ce0e9f10d05eb3088fc78c8

                                                                                                                      SHA256

                                                                                                                      ef4e0a82bb51865b4e30b570a50d82fecac5bb66d710fe8311e1275ef74b2134

                                                                                                                      SHA512

                                                                                                                      2651dcf8c9bd11b8d671432eb25fc6a225b5657e6518887208e904497a9b9257b1d4c182d3a0c582ea5be6b5b9c771e9a6e505aed833a86b94c35754d12cdb21

                                                                                                                    • C:\Users\Admin\Documents\vyY61MrbMtVFXXZkqCfTIZIx.exe
                                                                                                                      MD5

                                                                                                                      1200d489e366eee5647b09dc1f024db7

                                                                                                                      SHA1

                                                                                                                      4d0db82bee0608499ce0e9f10d05eb3088fc78c8

                                                                                                                      SHA256

                                                                                                                      ef4e0a82bb51865b4e30b570a50d82fecac5bb66d710fe8311e1275ef74b2134

                                                                                                                      SHA512

                                                                                                                      2651dcf8c9bd11b8d671432eb25fc6a225b5657e6518887208e904497a9b9257b1d4c182d3a0c582ea5be6b5b9c771e9a6e505aed833a86b94c35754d12cdb21

                                                                                                                    • C:\Users\Admin\Documents\whHJbxfH9AWgXkofhYfT9UWV.exe
                                                                                                                      MD5

                                                                                                                      381232c6402797397244066837e26e4a

                                                                                                                      SHA1

                                                                                                                      43e19ae002e2b89c47c5cd811aee2589751db517

                                                                                                                      SHA256

                                                                                                                      25518802e293e44b386182c4674032cc10531dac650500264d08eaf938ab31d8

                                                                                                                      SHA512

                                                                                                                      61097c39ca04be34208e7bc35c7e84709153474a2fe4fabf23c4af4f83d4ae9b3c880b7c474d5350baf7f2918118cc1bc87d9152d7f4296a5d3b2567ffad6e55

                                                                                                                    • \Users\Admin\AppData\Local\Temp\7zSC260ED34\libcurl.dll
                                                                                                                      MD5

                                                                                                                      d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                      SHA1

                                                                                                                      028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                      SHA256

                                                                                                                      0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                      SHA512

                                                                                                                      857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                    • \Users\Admin\AppData\Local\Temp\7zSC260ED34\libcurl.dll
                                                                                                                      MD5

                                                                                                                      d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                      SHA1

                                                                                                                      028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                      SHA256

                                                                                                                      0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                      SHA512

                                                                                                                      857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                    • \Users\Admin\AppData\Local\Temp\7zSC260ED34\libcurlpp.dll
                                                                                                                      MD5

                                                                                                                      e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                      SHA1

                                                                                                                      b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                      SHA256

                                                                                                                      43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                      SHA512

                                                                                                                      9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                    • \Users\Admin\AppData\Local\Temp\7zSC260ED34\libgcc_s_dw2-1.dll
                                                                                                                      MD5

                                                                                                                      9aec524b616618b0d3d00b27b6f51da1

                                                                                                                      SHA1

                                                                                                                      64264300801a353db324d11738ffed876550e1d3

                                                                                                                      SHA256

                                                                                                                      59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                      SHA512

                                                                                                                      0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                    • \Users\Admin\AppData\Local\Temp\7zSC260ED34\libgcc_s_dw2-1.dll
                                                                                                                      MD5

                                                                                                                      9aec524b616618b0d3d00b27b6f51da1

                                                                                                                      SHA1

                                                                                                                      64264300801a353db324d11738ffed876550e1d3

                                                                                                                      SHA256

                                                                                                                      59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                      SHA512

                                                                                                                      0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                    • \Users\Admin\AppData\Local\Temp\7zSC260ED34\libgcc_s_dw2-1.dll
                                                                                                                      MD5

                                                                                                                      9aec524b616618b0d3d00b27b6f51da1

                                                                                                                      SHA1

                                                                                                                      64264300801a353db324d11738ffed876550e1d3

                                                                                                                      SHA256

                                                                                                                      59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                      SHA512

                                                                                                                      0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                    • \Users\Admin\AppData\Local\Temp\7zSC260ED34\libstdc++-6.dll
                                                                                                                      MD5

                                                                                                                      5e279950775baae5fea04d2cc4526bcc

                                                                                                                      SHA1

                                                                                                                      8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                      SHA256

                                                                                                                      97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                      SHA512

                                                                                                                      666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                    • \Users\Admin\AppData\Local\Temp\7zSC260ED34\libwinpthread-1.dll
                                                                                                                      MD5

                                                                                                                      1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                      SHA1

                                                                                                                      fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                      SHA256

                                                                                                                      509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                      SHA512

                                                                                                                      3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                    • \Users\Admin\AppData\Local\Temp\axhub.dll
                                                                                                                      MD5

                                                                                                                      1c7be730bdc4833afb7117d48c3fd513

                                                                                                                      SHA1

                                                                                                                      dc7e38cfe2ae4a117922306aead5a7544af646b8

                                                                                                                      SHA256

                                                                                                                      8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

                                                                                                                      SHA512

                                                                                                                      7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

                                                                                                                    • memory/372-143-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/744-414-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/744-419-0x0000000000CD0000-0x0000000000D2D000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      372KB

                                                                                                                    • memory/744-418-0x0000000000B7A000-0x0000000000C7B000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      1.0MB

                                                                                                                    • memory/1000-176-0x000001EE5E830000-0x000001EE5E8A1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      452KB

                                                                                                                    • memory/1040-194-0x000001AB154B0000-0x000001AB15521000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      452KB

                                                                                                                    • memory/1164-193-0x000001EAD71D0000-0x000001EAD7241000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      452KB

                                                                                                                    • memory/1204-197-0x0000011CC17B0000-0x0000011CC1821000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      452KB

                                                                                                                    • memory/1340-533-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/1340-149-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/1348-303-0x0000000000B50000-0x0000000000B51000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/1348-283-0x00000000000A0000-0x00000000000A1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/1348-205-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/1348-309-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/1356-535-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/1396-198-0x000001E83A8D0000-0x000001E83A941000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      452KB

                                                                                                                    • memory/1416-195-0x000002ED05010000-0x000002ED05081000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      452KB

                                                                                                                    • memory/1436-477-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/1468-140-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/1580-114-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/1680-493-0x000000000046B76D-mapping.dmp
                                                                                                                    • memory/1700-440-0x0000000002F50000-0x0000000002F66000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      88KB

                                                                                                                    • memory/1728-382-0x0000000005720000-0x0000000005D26000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      6.0MB

                                                                                                                    • memory/1728-352-0x0000000000418836-mapping.dmp
                                                                                                                    • memory/1784-462-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/1796-210-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/1796-280-0x0000000004CE0000-0x0000000004CE1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/1796-261-0x0000000000430000-0x0000000000431000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/1800-215-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/1800-388-0x0000000002330000-0x000000000233A000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      40KB

                                                                                                                    • memory/1852-196-0x000002B355330000-0x000002B3553A1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      452KB

                                                                                                                    • memory/1972-211-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/2084-391-0x0000000004F72000-0x0000000004F73000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2084-392-0x0000000004F73000-0x0000000004F74000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2084-217-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/2084-387-0x0000000004F70000-0x0000000004F71000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2084-371-0x0000000004F74000-0x0000000004F76000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                    • memory/2084-378-0x0000000000400000-0x00000000008B6000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4.7MB

                                                                                                                    • memory/2084-377-0x0000000000A00000-0x0000000000B4A000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      1.3MB

                                                                                                                    • memory/2096-117-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/2096-133-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      572KB

                                                                                                                    • memory/2096-148-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      100KB

                                                                                                                    • memory/2096-492-0x000000000044003F-mapping.dmp
                                                                                                                    • memory/2096-147-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      100KB

                                                                                                                    • memory/2096-146-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      100KB

                                                                                                                    • memory/2096-135-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      152KB

                                                                                                                    • memory/2096-136-0x0000000000400000-0x000000000051E000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      1.1MB

                                                                                                                    • memory/2096-134-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      1.5MB

                                                                                                                    • memory/2096-145-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      100KB

                                                                                                                    • memory/2128-260-0x00000000004A0000-0x00000000004A1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2128-218-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/2128-279-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2128-513-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/2180-274-0x00000000005E0000-0x00000000005E1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2180-212-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/2224-311-0x0000000005130000-0x0000000005131000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2224-325-0x0000000005640000-0x0000000005641000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2224-206-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/2224-289-0x00000000005D0000-0x00000000005D1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2232-550-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/2260-485-0x000000000046B76D-mapping.dmp
                                                                                                                    • memory/2260-139-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/2364-175-0x0000013FA6640000-0x0000013FA66B1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      452KB

                                                                                                                    • memory/2380-170-0x000001E1BB560000-0x000001E1BB5D1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      452KB

                                                                                                                    • memory/2424-207-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/2424-315-0x0000000005150000-0x0000000005151000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2424-282-0x00000000007A0000-0x00000000007A1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2588-174-0x000001DF3C5D0000-0x000001DF3C641000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      452KB

                                                                                                                    • memory/2588-204-0x000001DF3EE00000-0x000001DF3EF06000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      1.0MB

                                                                                                                    • memory/2588-203-0x000001DF3DDF0000-0x000001DF3DE0B000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      108KB

                                                                                                                    • memory/2588-157-0x00007FF6E4F44060-mapping.dmp
                                                                                                                    • memory/2596-172-0x0000016AA1910000-0x0000016AA1981000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      452KB

                                                                                                                    • memory/2672-200-0x000001DFC3100000-0x000001DFC3171000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      452KB

                                                                                                                    • memory/2672-192-0x000001DFC27A0000-0x000001DFC27A2000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                    • memory/2692-199-0x0000024ADA440000-0x0000024ADA4B1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      452KB

                                                                                                                    • memory/2692-190-0x0000024AD9AD0000-0x0000024AD9AD2000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                    • memory/2740-152-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/2740-166-0x0000000004320000-0x000000000437D000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      372KB

                                                                                                                    • memory/2740-164-0x0000000004461000-0x0000000004562000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      1.0MB

                                                                                                                    • memory/3116-358-0x000000000041883A-mapping.dmp
                                                                                                                    • memory/3116-380-0x0000000004E90000-0x0000000005496000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      6.0MB

                                                                                                                    • memory/3428-393-0x0000000000400000-0x0000000000409000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                    • memory/3428-359-0x0000000000402E1A-mapping.dmp
                                                                                                                    • memory/3492-141-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/3700-339-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/3920-363-0x0000000000400000-0x000000000044E000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      312KB

                                                                                                                    • memory/3920-343-0x0000000000400000-0x000000000044E000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      312KB

                                                                                                                    • memory/3920-347-0x0000000000401480-mapping.dmp
                                                                                                                    • memory/3948-169-0x000001AFD7430000-0x000001AFD74A1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      452KB

                                                                                                                    • memory/3948-421-0x000001AFD73C0000-0x000001AFD740C000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      304KB

                                                                                                                    • memory/3948-156-0x000001AFD7090000-0x000001AFD7092000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                    • memory/3948-422-0x000001AFD7670000-0x000001AFD76E1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      452KB

                                                                                                                    • memory/3948-168-0x000001AFD7370000-0x000001AFD73BC000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      304KB

                                                                                                                    • memory/4088-534-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4100-267-0x0000000000170000-0x0000000000171000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4100-214-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4108-281-0x00000000003F0000-0x00000000003F1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4108-290-0x0000000004CA0000-0x0000000004CA1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4108-209-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4108-319-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4112-528-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4116-345-0x0000025ACB090000-0x0000025ACB160000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      832KB

                                                                                                                    • memory/4116-342-0x0000025ACB020000-0x0000025ACB08F000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      444KB

                                                                                                                    • memory/4116-208-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4124-213-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4132-375-0x000001738EFA0000-0x000001738F070000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      832KB

                                                                                                                    • memory/4132-302-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4164-285-0x0000000000B30000-0x0000000000B31000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4164-300-0x0000000000B40000-0x0000000000B63000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      140KB

                                                                                                                    • memory/4164-273-0x0000000000600000-0x0000000000601000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4164-307-0x0000000000B70000-0x0000000000B71000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4164-216-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4164-301-0x000000001B3E0000-0x000000001B3E2000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                    • memory/4184-219-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4184-275-0x00000000007E0000-0x00000000007E1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4196-220-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4196-423-0x0000000000400000-0x0000000000D41000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      9.3MB

                                                                                                                    • memory/4196-416-0x0000000002FA0000-0x00000000038C6000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      9.1MB

                                                                                                                    • memory/4212-221-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4212-310-0x0000000076FB0000-0x000000007713E000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      1.6MB

                                                                                                                    • memory/4212-313-0x00000000013A0000-0x00000000013A1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4212-338-0x0000000001300000-0x0000000001301000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4220-320-0x0000000006920000-0x0000000006921000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4220-341-0x0000000006300000-0x0000000006301000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4220-322-0x0000000076FB0000-0x000000007713E000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      1.6MB

                                                                                                                    • memory/4220-324-0x00000000061B0000-0x00000000061B1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4220-312-0x0000000001160000-0x0000000001161000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4220-222-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4252-224-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4252-367-0x0000000002570000-0x000000000260D000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      628KB

                                                                                                                    • memory/4252-384-0x0000000000400000-0x00000000008F9000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      5.0MB

                                                                                                                    • memory/4336-411-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4476-386-0x0000000000400000-0x00000000008B0000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4.7MB

                                                                                                                    • memory/4476-253-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4476-385-0x00000000008B0000-0x00000000009FA000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      1.3MB

                                                                                                                    • memory/4484-254-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4496-328-0x0000000076FB0000-0x000000007713E000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      1.6MB

                                                                                                                    • memory/4496-334-0x0000000005D80000-0x0000000005D81000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4496-331-0x0000000005D40000-0x0000000005D41000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4496-337-0x0000000005CA0000-0x0000000005CA1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4496-314-0x0000000000870000-0x0000000000871000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4496-255-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4496-344-0x0000000005FE0000-0x0000000005FE1000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4524-340-0x00000000008B0000-0x00000000008F7000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      284KB

                                                                                                                    • memory/4524-257-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4528-458-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4572-396-0x0000000000417DEE-mapping.dmp
                                                                                                                    • memory/4572-409-0x0000000005590000-0x0000000005B96000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      6.0MB

                                                                                                                    • memory/4788-483-0x0000000000417DE2-mapping.dmp
                                                                                                                    • memory/4832-556-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4856-557-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/4868-487-0x0000000000417E06-mapping.dmp
                                                                                                                    • memory/4976-402-0x0000000000418836-mapping.dmp
                                                                                                                    • memory/4976-417-0x00000000056E0000-0x0000000005CE6000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      6.0MB

                                                                                                                    • memory/4984-394-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/5008-288-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/5048-373-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/5080-295-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/5116-299-0x0000000000000000-mapping.dmp
                                                                                                                    • memory/5116-308-0x0000000000400000-0x000000000064F000-memory.dmp
                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/5168-558-0x0000000000000000-mapping.dmp