Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

09/01/2023, 12:46

230109-pzzzkaeb73 10

31/12/2022, 16:26

221231-txqekahh85 10

31/12/2022, 16:11

221231-tnc3wahh62 10

Analysis

  • max time kernel
    300s
  • max time network
    394s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/01/2023, 12:46

General

  • Target

    2f7a15691c51124019ccf5cbde2f399e52164f645b70bf4aaab596391146bb7f.exe

  • Size

    262KB

  • MD5

    a58ba818715cbcd50fff388b246e04d1

  • SHA1

    52ebdb14a8e3d61ffc6b3df3d76c4434733ea7de

  • SHA256

    2f7a15691c51124019ccf5cbde2f399e52164f645b70bf4aaab596391146bb7f

  • SHA512

    d6a98a816a0e5561128d674371f130cf43b68bc4c350866b20d1eac970e4c5aa4db53badec16dc27df3695e97d2bdb6e6fa8ae72981324671c060457c03339ee

  • SSDEEP

    3072:MlLntn1Y9zL3g7foklrmRQXN7SCzyLgCmN6kb5vfOxOvlmqrzn8f227hZY:sneL3qocb7SufCJ4SOYcn8rZY

Malware Config

Extracted

Family

djvu

C2

http://spaceris.com/lancer/get.php

Attributes
  • extension

    .zouu

  • offline_id

    7hl6KB3alcoZ6n4DhS2rApCezkIMzShntAiXWMt1

  • payload_url

    http://uaery.top/dl/build2.exe

    http://spaceris.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-N3pXlaPXFm Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0631JOsie

rsa_pubkey.plain

Extracted

Family

aurora

C2

82.115.223.77:8081

Extracted

Family

vidar

Version

1.8

Botnet

19

C2

https://t.me/year2023start

https://steamcommunity.com/profiles/76561199467421923

Attributes
  • profile_id

    19

Signatures

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

  • DcRat 5 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Detected Djvu ransomware 10 IoCs
  • Detects Smokeloader packer 2 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Blocklisted process makes network request 64 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 18 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 5 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 40 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f7a15691c51124019ccf5cbde2f399e52164f645b70bf4aaab596391146bb7f.exe
    "C:\Users\Admin\AppData\Local\Temp\2f7a15691c51124019ccf5cbde2f399e52164f645b70bf4aaab596391146bb7f.exe"
    1⤵
    • DcRat
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4136
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1760
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 476 -p 4896 -ip 4896
    1⤵
      PID:4400
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4896 -s 2472
      1⤵
      • Program crash
      PID:3100
    • C:\Users\Admin\AppData\Local\Temp\E738.exe
      C:\Users\Admin\AppData\Local\Temp\E738.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:720
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 1252
        2⤵
        • Program crash
        PID:3920
    • C:\Users\Admin\AppData\Local\Temp\E95C.exe
      C:\Users\Admin\AppData\Local\Temp\E95C.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4780
    • C:\Users\Admin\AppData\Local\Temp\EE4F.exe
      C:\Users\Admin\AppData\Local\Temp\EE4F.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1572
    • C:\Users\Admin\AppData\Local\Temp\F17C.exe
      C:\Users\Admin\AppData\Local\Temp\F17C.exe
      1⤵
      • Executes dropped EXE
      PID:3856
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 340
        2⤵
        • Program crash
        PID:1184
    • C:\Users\Admin\AppData\Local\Temp\F4F8.exe
      C:\Users\Admin\AppData\Local\Temp\F4F8.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3576
      • C:\Users\Admin\AppData\Local\Temp\F4F8.exe
        C:\Users\Admin\AppData\Local\Temp\F4F8.exe
        2⤵
        • DcRat
        • Executes dropped EXE
        • Checks computer location settings
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:748
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Users\Admin\AppData\Local\1843ef78-7b18-4241-a3da-b93e861de0c2" /deny *S-1-1-0:(OI)(CI)(DE,DC)
          3⤵
          • Modifies file permissions
          PID:4728
        • C:\Users\Admin\AppData\Local\Temp\F4F8.exe
          "C:\Users\Admin\AppData\Local\Temp\F4F8.exe" --Admin IsNotAutoStart IsNotTask
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1284
          • C:\Users\Admin\AppData\Local\Temp\F4F8.exe
            "C:\Users\Admin\AppData\Local\Temp\F4F8.exe" --Admin IsNotAutoStart IsNotTask
            4⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:4176
            • C:\Users\Admin\AppData\Local\9d87f84d-b658-43a1-9daf-8de6b126c79b\build2.exe
              "C:\Users\Admin\AppData\Local\9d87f84d-b658-43a1-9daf-8de6b126c79b\build2.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:3012
              • C:\Users\Admin\AppData\Local\9d87f84d-b658-43a1-9daf-8de6b126c79b\build2.exe
                "C:\Users\Admin\AppData\Local\9d87f84d-b658-43a1-9daf-8de6b126c79b\build2.exe"
                6⤵
                • Executes dropped EXE
                • Checks computer location settings
                • Loads dropped DLL
                • Checks processor information in registry
                PID:2100
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\9d87f84d-b658-43a1-9daf-8de6b126c79b\build2.exe" & exit
                  7⤵
                    PID:2684
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 6
                      8⤵
                      • Delays execution with timeout.exe
                      PID:4548
              • C:\Users\Admin\AppData\Local\9d87f84d-b658-43a1-9daf-8de6b126c79b\build3.exe
                "C:\Users\Admin\AppData\Local\9d87f84d-b658-43a1-9daf-8de6b126c79b\build3.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3704
                • C:\Windows\SysWOW64\schtasks.exe
                  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                  6⤵
                  • DcRat
                  • Creates scheduled task(s)
                  PID:3900
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3856 -ip 3856
        1⤵
          PID:3720
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 720 -ip 720
          1⤵
            PID:3904
          • C:\Users\Admin\AppData\Local\Temp\4F2E.exe
            C:\Users\Admin\AppData\Local\Temp\4F2E.exe
            1⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:2768
            • C:\Users\Admin\AppData\Roaming\venuzye.exe
              "C:\Users\Admin\AppData\Roaming\venuzye.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:368
              • C:\Windows\System32\Wbem\wmic.exe
                wmic os get Caption
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4208
              • C:\Windows\system32\cmd.exe
                cmd /C "wmic path win32_VideoController get name"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:792
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic path win32_VideoController get name
                  4⤵
                    PID:2188
                • C:\Windows\system32\cmd.exe
                  cmd /C "wmic cpu get name"
                  3⤵
                    PID:3252
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic cpu get name
                      4⤵
                        PID:3596
                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4604
                  • C:\Windows\SysWOW64\schtasks.exe
                    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                    2⤵
                    • DcRat
                    • Creates scheduled task(s)
                    PID:4984
                • C:\Users\Admin\AppData\Local\Temp\B4A0.exe
                  C:\Users\Admin\AppData\Local\Temp\B4A0.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4452
                  • C:\Windows\SysWOW64\rundll32.exe
                    "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Wtfoiq.tmp",Iyidwoiowsw
                    2⤵
                    • Blocklisted process makes network request
                    • Sets DLL path for service in the registry
                    • Sets service image path in registry
                    • Loads dropped DLL
                    • Accesses Microsoft Outlook accounts
                    • Accesses Microsoft Outlook profiles
                    • Suspicious use of SetThreadContext
                    • Drops file in Program Files directory
                    • Checks processor information in registry
                    • Modifies system certificate store
                    • outlook_office_path
                    • outlook_win_path
                    PID:2532
                    • C:\Windows\system32\rundll32.exe
                      "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 15570
                      3⤵
                        PID:3336
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
                        3⤵
                          PID:3324
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
                          3⤵
                            PID:1860
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 320
                          2⤵
                          • Program crash
                          PID:2680
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4452 -ip 4452
                        1⤵
                          PID:5064
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                          1⤵
                          • Enumerates system info in registry
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          PID:3848
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x120,0x124,0xd4,0x128,0x7ffa6e634f50,0x7ffa6e634f60,0x7ffa6e634f70
                            2⤵
                              PID:3948
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1704 /prefetch:2
                              2⤵
                                PID:4808
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2060 /prefetch:8
                                2⤵
                                  PID:5036
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2332 /prefetch:8
                                  2⤵
                                    PID:3820
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1
                                    2⤵
                                      PID:4612
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
                                      2⤵
                                        PID:2256
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
                                        2⤵
                                          PID:976
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4500 /prefetch:8
                                          2⤵
                                            PID:1020
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4564 /prefetch:8
                                            2⤵
                                              PID:4204
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4816 /prefetch:8
                                              2⤵
                                                PID:528
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4632 /prefetch:8
                                                2⤵
                                                  PID:3200
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:8
                                                  2⤵
                                                    PID:3284
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5016 /prefetch:8
                                                    2⤵
                                                      PID:2096
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5212 /prefetch:8
                                                      2⤵
                                                        PID:2880
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5116 /prefetch:8
                                                        2⤵
                                                          PID:4536
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                                                          2⤵
                                                            PID:5028
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
                                                            2⤵
                                                              PID:4136
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
                                                              2⤵
                                                                PID:224
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
                                                                2⤵
                                                                  PID:2544
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6052 /prefetch:8
                                                                  2⤵
                                                                    PID:1088
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5556 /prefetch:8
                                                                    2⤵
                                                                      PID:1788
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
                                                                      2⤵
                                                                        PID:5096
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2840 /prefetch:8
                                                                        2⤵
                                                                          PID:2032
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:8
                                                                          2⤵
                                                                            PID:4028
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
                                                                            2⤵
                                                                              PID:380
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2704 /prefetch:8
                                                                              2⤵
                                                                                PID:2088
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
                                                                                2⤵
                                                                                  PID:3928
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
                                                                                  2⤵
                                                                                    PID:2880
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5316 /prefetch:8
                                                                                    2⤵
                                                                                      PID:2612
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 /prefetch:8
                                                                                      2⤵
                                                                                        PID:396
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2608 /prefetch:1
                                                                                        2⤵
                                                                                          PID:2680
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
                                                                                          2⤵
                                                                                            PID:992
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1044 /prefetch:8
                                                                                            2⤵
                                                                                              PID:1176
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1608 /prefetch:8
                                                                                              2⤵
                                                                                                PID:204
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3544 /prefetch:2
                                                                                                2⤵
                                                                                                  PID:1572
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1032 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:4404
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2772 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:1544
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6124 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:1576
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6284 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:2356
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6244 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:3516
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6384 /prefetch:8
                                                                                                            2⤵
                                                                                                              PID:1064
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6408 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:2208
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6592 /prefetch:8
                                                                                                                2⤵
                                                                                                                  PID:720
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6556 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:2892
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:1020
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:4916
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:4868
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:4140
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:2684
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:4212
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5560 /prefetch:8
                                                                                                                                2⤵
                                                                                                                                  PID:1688
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
                                                                                                                                  2⤵
                                                                                                                                    PID:2944
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:8
                                                                                                                                    2⤵
                                                                                                                                      PID:3200
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6156 /prefetch:8
                                                                                                                                      2⤵
                                                                                                                                        PID:4200
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1668,4827902206882255530,1713183846994685492,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2212 /prefetch:8
                                                                                                                                        2⤵
                                                                                                                                          PID:4336
                                                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                        1⤵
                                                                                                                                          PID:5092
                                                                                                                                        • C:\Windows\System32\rundll32.exe
                                                                                                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                          1⤵
                                                                                                                                            PID:4536
                                                                                                                                          • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                            "C:\Windows\system32\NOTEPAD.EXE" C:\SystemID\PersonalID.txt
                                                                                                                                            1⤵
                                                                                                                                            • Opens file in notepad (likely ransom note)
                                                                                                                                            PID:1988
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\urjgbsd
                                                                                                                                            C:\Users\Admin\AppData\Roaming\urjgbsd
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                            PID:4332
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\ajjgbsd
                                                                                                                                            C:\Users\Admin\AppData\Roaming\ajjgbsd
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:4196
                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 320
                                                                                                                                              2⤵
                                                                                                                                              • Program crash
                                                                                                                                              PID:3788
                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4196 -ip 4196
                                                                                                                                            1⤵
                                                                                                                                              PID:1440
                                                                                                                                            • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                              C:\Windows\SysWOW64\svchost.exe -k LocalService
                                                                                                                                              1⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Checks processor information in registry
                                                                                                                                              PID:4064
                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\cpdf_rhp..dll",XgZYYzY3NQ==
                                                                                                                                                2⤵
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                • Checks processor information in registry
                                                                                                                                                PID:2936
                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\cpdf_rhp..dll",XgZYYzY3NQ==
                                                                                                                                                2⤵
                                                                                                                                                  PID:2280
                                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                                    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 15570
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1416
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4720
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2916
                                                                                                                                                    • C:\Users\Admin\Desktop\adwcleaner.exe
                                                                                                                                                      "C:\Users\Admin\Desktop\adwcleaner.exe"
                                                                                                                                                      1⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:1664
                                                                                                                                                      • C:\Windows\System32\netsh.exe
                                                                                                                                                        "C:\Windows\System32\netsh.exe" winsock reset
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1768
                                                                                                                                                      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                                        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                                        1⤵
                                                                                                                                                          PID:4964
                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                          1⤵
                                                                                                                                                            PID:5020
                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                            1⤵
                                                                                                                                                              PID:4716
                                                                                                                                                            • C:\Windows\system32\taskmgr.exe
                                                                                                                                                              "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                              1⤵
                                                                                                                                                                PID:2132
                                                                                                                                                              • C:\Users\Admin\Desktop\adwcleaner.exe
                                                                                                                                                                "C:\Users\Admin\Desktop\adwcleaner.exe"
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:1932
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:3456
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                                                                                                                                                      2⤵
                                                                                                                                                                      • DcRat
                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                      PID:4228
                                                                                                                                                                  • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                    "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:4824

                                                                                                                                                                    Network

                                                                                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                                                                                    Replay Monitor

                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                    Downloads

                                                                                                                                                                    • C:\ProgramData\mozglue.dll

                                                                                                                                                                      Filesize

                                                                                                                                                                      133KB

                                                                                                                                                                      MD5

                                                                                                                                                                      8f73c08a9660691143661bf7332c3c27

                                                                                                                                                                      SHA1

                                                                                                                                                                      37fa65dd737c50fda710fdbde89e51374d0c204a

                                                                                                                                                                      SHA256

                                                                                                                                                                      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                                                                                                                                                                      SHA512

                                                                                                                                                                      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                                                                                                                                                                    • C:\ProgramData\nss3.dll

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                      MD5

                                                                                                                                                                      bfac4e3c5908856ba17d41edcd455a51

                                                                                                                                                                      SHA1

                                                                                                                                                                      8eec7e888767aa9e4cca8ff246eb2aacb9170428

                                                                                                                                                                      SHA256

                                                                                                                                                                      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                                                                                                                                                                      SHA512

                                                                                                                                                                      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                                                                                                                                                                    • C:\SystemID\PersonalID.txt

                                                                                                                                                                      Filesize

                                                                                                                                                                      42B

                                                                                                                                                                      MD5

                                                                                                                                                                      15a69b8e478da0a3c34463ce2a3c9727

                                                                                                                                                                      SHA1

                                                                                                                                                                      9ee632cb0e17b760f5655d67f21ad9dd9c124793

                                                                                                                                                                      SHA256

                                                                                                                                                                      00dc9381b42367952477eceac3373f4808fce89ee8ef08f89eb62fb68bafce46

                                                                                                                                                                      SHA512

                                                                                                                                                                      e6c87e615a7044cb7c9a4fac6f1db28520c4647c46a27bf8e30dcd10742f7d4f3360ead47cd67f531de976c71b91ecb45cf0ac5d1d472fa00b8eed643514feff

                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

                                                                                                                                                                      Filesize

                                                                                                                                                                      2KB

                                                                                                                                                                      MD5

                                                                                                                                                                      61a9f01083346a0ee40dc68983932b14

                                                                                                                                                                      SHA1

                                                                                                                                                                      85737a00e510acc709a5ea03d04a666bf41eb912

                                                                                                                                                                      SHA256

                                                                                                                                                                      db745e7939f305e69baa8e6fda50687f545b5b9af3cffbd290f1223d7956c1e7

                                                                                                                                                                      SHA512

                                                                                                                                                                      80edf82ede77a5657e92ca9c6ec45fe28118f1f0372d33e377185f7043580ee136927922556795552b41b9bd03aaef9a0273758af375b56ad4470aa23ac88349

                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

                                                                                                                                                                      Filesize

                                                                                                                                                                      1KB

                                                                                                                                                                      MD5

                                                                                                                                                                      589514a7ae90cdf114f5f63d720a442a

                                                                                                                                                                      SHA1

                                                                                                                                                                      63632187f607aa50c81654650f7ed673ac7e86c9

                                                                                                                                                                      SHA256

                                                                                                                                                                      e685f6216919f46392498db07a4539ee3c312eb20302e77d3cd8d69d1a805a6a

                                                                                                                                                                      SHA512

                                                                                                                                                                      efd43cd28866a7ddf9749ccff3903e82118e8bf3792f2b7095ab614c165de317d7b6bf3b6002d5950a127bcea27641b7f61270be1391e5cfe91e0d5ccc058beb

                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

                                                                                                                                                                      Filesize

                                                                                                                                                                      1KB

                                                                                                                                                                      MD5

                                                                                                                                                                      deb5907196e6e5e0e915c276f65a6924

                                                                                                                                                                      SHA1

                                                                                                                                                                      62802115ee04a17e66297fbfd5ab8d933040ffdb

                                                                                                                                                                      SHA256

                                                                                                                                                                      48c65c4f7dfbf070a4e8157cd0ec68e495eb3f963668f3d51ae6fedcff7fcda1

                                                                                                                                                                      SHA512

                                                                                                                                                                      4881fd5f46e1846f4e4dd3cb0295c5b48f62181bba01f8113520d97ee31b1489429281778d1ac0d58d02a3343ad97d24a96ce1d2bdbb1ddda2f77e5101f51c43

                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

                                                                                                                                                                      Filesize

                                                                                                                                                                      1KB

                                                                                                                                                                      MD5

                                                                                                                                                                      d4664502930ea449b4f2e942ed6ed2f6

                                                                                                                                                                      SHA1

                                                                                                                                                                      e4278c7ee950a97f801b087b01e6dc96e5db6954

                                                                                                                                                                      SHA256

                                                                                                                                                                      efa9a60de4cddc87056655b0a6da382ba5b11611c1beadfc6e1c9d6d3bab027f

                                                                                                                                                                      SHA512

                                                                                                                                                                      45ecc51bbea32c082195e1b4d97052bae901c25d2e5192b93fe343905a09be1c2bbc31fe6dd35830e7d799f355408d3acbd4e7e0cb81c3690f202a20ee738b73

                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

                                                                                                                                                                      Filesize

                                                                                                                                                                      488B

                                                                                                                                                                      MD5

                                                                                                                                                                      f474b275969640513db3dc061d3909a9

                                                                                                                                                                      SHA1

                                                                                                                                                                      563011fec6d62b9dd4ff5b0113a338629f3e5e9a

                                                                                                                                                                      SHA256

                                                                                                                                                                      9927fa0040df2332e2419565db474a9a47aa46fee3afe9d8e5fa33f2dd56785b

                                                                                                                                                                      SHA512

                                                                                                                                                                      8e16bbc14c43a154195b7be4537d72fd189c66ca06adb6cfb69343b991dfde9bd85e87d87f7e8f804745968da55f603e8a7f0f68b4f87807b213b6c1401c7350

                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

                                                                                                                                                                      Filesize

                                                                                                                                                                      450B

                                                                                                                                                                      MD5

                                                                                                                                                                      5bbe8516388fe0fce415ae28c5362de2

                                                                                                                                                                      SHA1

                                                                                                                                                                      eacef2e7d8db8c0f9f2bf8f6403ec31ac3d4366c

                                                                                                                                                                      SHA256

                                                                                                                                                                      37cb99e0355ea52a55a7cb7b30d9351c76c78ff4708defb1cc2b5c1cb80935f2

                                                                                                                                                                      SHA512

                                                                                                                                                                      182c07acc80bbbf1481f610cf051ccdc9ddeba418b58bdb9e5d0527db362a1cad7d16cff334424417f2a0dc770d303da276b1e936b50897b92f0837945f1c2f7

                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

                                                                                                                                                                      Filesize

                                                                                                                                                                      482B

                                                                                                                                                                      MD5

                                                                                                                                                                      15baab7248c313c1a426f18d1d692f3b

                                                                                                                                                                      SHA1

                                                                                                                                                                      36e5afe8b622555b61ef301f564c955a4a28316c

                                                                                                                                                                      SHA256

                                                                                                                                                                      d24fccfea91133c5d652cb07556e5144f430839f2f0de66a7ad9773ffbb9707a

                                                                                                                                                                      SHA512

                                                                                                                                                                      ac66a65fbcd96acdb970d94d1df486dd237e02b157bb2e2e8deb05f0d5ef1677014e2b95571c0e20df5ab9ce2c3870c996f5c8b2628571e1c318a15b4639da04

                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

                                                                                                                                                                      Filesize

                                                                                                                                                                      458B

                                                                                                                                                                      MD5

                                                                                                                                                                      4893aaf0a89f1529eb89f8728ae29fa8

                                                                                                                                                                      SHA1

                                                                                                                                                                      083f732523fa029fce5f206ab6ce7479a9995015

                                                                                                                                                                      SHA256

                                                                                                                                                                      d35af0bf9d20720f80b7cadb0c0e2ef20351447dfc1c3f7d6510eadc5b3bb25f

                                                                                                                                                                      SHA512

                                                                                                                                                                      1f07a69061fead59e5921847f38287901202851e10f9235c976cfd3a838f606e4af93f090ea1a297da873cbc68286be76af64ec3d15f539ede20b26f3eed5689

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\1843ef78-7b18-4241-a3da-b93e861de0c2\F4F8.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      852KB

                                                                                                                                                                      MD5

                                                                                                                                                                      5a4646dc1e0caa4a0c2da0ddb1c7e97f

                                                                                                                                                                      SHA1

                                                                                                                                                                      bd57414c9549641a54a27cb7868d318689685938

                                                                                                                                                                      SHA256

                                                                                                                                                                      9fe04c781e72a87b131df24fa7f16567fcfe4c16c8e812650e5d583c65e6e3ba

                                                                                                                                                                      SHA512

                                                                                                                                                                      6faf7a612b810595d44bbe8bf0c0637a76794d2831e85e4f0377b6fca0ee5383f364f5b3c0c87dc17d3ac13b7cfc43a738e64bc0fd129fa0921c7d87f0b9b651

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\9d87f84d-b658-43a1-9daf-8de6b126c79b\build2.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      429KB

                                                                                                                                                                      MD5

                                                                                                                                                                      8c14bb1505244971374a88f37a4ec22a

                                                                                                                                                                      SHA1

                                                                                                                                                                      cebd478fd7ca3956c983fb3e33e2cbb7c54fa4d0

                                                                                                                                                                      SHA256

                                                                                                                                                                      f333289bf29805ee697908ecb974aeb81206b471252ec2e51f382d53ac35d962

                                                                                                                                                                      SHA512

                                                                                                                                                                      5e08686f2cbc783716442004d39ee11a4fabec7aaa92f33f758df7861ed0730c211551ecb85dd9dc93c2b83983fc4df08bcfeeb38c9e51bd3dcd138b10cf103e

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\9d87f84d-b658-43a1-9daf-8de6b126c79b\build2.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      429KB

                                                                                                                                                                      MD5

                                                                                                                                                                      8c14bb1505244971374a88f37a4ec22a

                                                                                                                                                                      SHA1

                                                                                                                                                                      cebd478fd7ca3956c983fb3e33e2cbb7c54fa4d0

                                                                                                                                                                      SHA256

                                                                                                                                                                      f333289bf29805ee697908ecb974aeb81206b471252ec2e51f382d53ac35d962

                                                                                                                                                                      SHA512

                                                                                                                                                                      5e08686f2cbc783716442004d39ee11a4fabec7aaa92f33f758df7861ed0730c211551ecb85dd9dc93c2b83983fc4df08bcfeeb38c9e51bd3dcd138b10cf103e

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\9d87f84d-b658-43a1-9daf-8de6b126c79b\build3.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      9KB

                                                                                                                                                                      MD5

                                                                                                                                                                      9ead10c08e72ae41921191f8db39bc16

                                                                                                                                                                      SHA1

                                                                                                                                                                      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                                                                                      SHA256

                                                                                                                                                                      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                                                                                      SHA512

                                                                                                                                                                      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

                                                                                                                                                                      Filesize

                                                                                                                                                                      28KB

                                                                                                                                                                      MD5

                                                                                                                                                                      3b21faa6836429a86efdb74220343bad

                                                                                                                                                                      SHA1

                                                                                                                                                                      a5efb1980a3f4dfbe5a266e83b1d68ad9f03cd5d

                                                                                                                                                                      SHA256

                                                                                                                                                                      b47412e47985bd20a4138f1ea0cac4de635a394238a051a1f57d374fe49af4d9

                                                                                                                                                                      SHA512

                                                                                                                                                                      a374993022ddcc52de00e20d3209fdc6e57cd55cbbb1b9c16a3a23ce6d2d8b57a4bd52e83857b275fb79b7dc07202dad144b353a969788f513dff9a6c9fa6165

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4F2E.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      15.9MB

                                                                                                                                                                      MD5

                                                                                                                                                                      759c12b796e6748a79b1317056194a6d

                                                                                                                                                                      SHA1

                                                                                                                                                                      2931c81c3d03d8c2bf7e47cda59c46059c07bab8

                                                                                                                                                                      SHA256

                                                                                                                                                                      d9ca3bd415f28b6e760fc9e501f65c2293d59666a9a9445a56d054f3e0c35b93

                                                                                                                                                                      SHA512

                                                                                                                                                                      e4940185b7923d93060c33f0fe220216c97bbdf2b1bc62ab9965882f82a8ec7d262fc66fa6f96d6d5cf8790cbf3aa4c7be652fd713b415ff7ff966d8a0411cab

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4F2E.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      15.9MB

                                                                                                                                                                      MD5

                                                                                                                                                                      759c12b796e6748a79b1317056194a6d

                                                                                                                                                                      SHA1

                                                                                                                                                                      2931c81c3d03d8c2bf7e47cda59c46059c07bab8

                                                                                                                                                                      SHA256

                                                                                                                                                                      d9ca3bd415f28b6e760fc9e501f65c2293d59666a9a9445a56d054f3e0c35b93

                                                                                                                                                                      SHA512

                                                                                                                                                                      e4940185b7923d93060c33f0fe220216c97bbdf2b1bc62ab9965882f82a8ec7d262fc66fa6f96d6d5cf8790cbf3aa4c7be652fd713b415ff7ff966d8a0411cab

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\B4A0.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.1MB

                                                                                                                                                                      MD5

                                                                                                                                                                      e7f1a070a914352c8e80242c1618732b

                                                                                                                                                                      SHA1

                                                                                                                                                                      669a862cdcad14ae1258c997f62f124c8fb1048f

                                                                                                                                                                      SHA256

                                                                                                                                                                      0749948b3bf98c2c5bc03060634d215542f87dab8a92677f1885cf0b9ea36f39

                                                                                                                                                                      SHA512

                                                                                                                                                                      18fbf494f375a2285f85774de8de75c2d89582e06b94c2a56266676a24e4b19c9a2e51afd0e039f01a48b142cfbe4661aba2b57e706d6f1cb527ac4b7d6d3faf

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\B4A0.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.1MB

                                                                                                                                                                      MD5

                                                                                                                                                                      e7f1a070a914352c8e80242c1618732b

                                                                                                                                                                      SHA1

                                                                                                                                                                      669a862cdcad14ae1258c997f62f124c8fb1048f

                                                                                                                                                                      SHA256

                                                                                                                                                                      0749948b3bf98c2c5bc03060634d215542f87dab8a92677f1885cf0b9ea36f39

                                                                                                                                                                      SHA512

                                                                                                                                                                      18fbf494f375a2285f85774de8de75c2d89582e06b94c2a56266676a24e4b19c9a2e51afd0e039f01a48b142cfbe4661aba2b57e706d6f1cb527ac4b7d6d3faf

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E738.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      426KB

                                                                                                                                                                      MD5

                                                                                                                                                                      5789f1c2e5a03d55327799a606e59195

                                                                                                                                                                      SHA1

                                                                                                                                                                      258ac4c218e4010560be0c51e21ee4c2480ec576

                                                                                                                                                                      SHA256

                                                                                                                                                                      5680d2e482451222f0be4ea9914d8073e6e2b59ac3008125794f95fb45f37b1d

                                                                                                                                                                      SHA512

                                                                                                                                                                      e84acfbe90132674c3c1b8abd573601d37cd6be882c80601a5c4675eb332c20e73723186af471ced333c67de9aed43ca797959f6dc5dc575b76712338c3c8561

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E738.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      426KB

                                                                                                                                                                      MD5

                                                                                                                                                                      5789f1c2e5a03d55327799a606e59195

                                                                                                                                                                      SHA1

                                                                                                                                                                      258ac4c218e4010560be0c51e21ee4c2480ec576

                                                                                                                                                                      SHA256

                                                                                                                                                                      5680d2e482451222f0be4ea9914d8073e6e2b59ac3008125794f95fb45f37b1d

                                                                                                                                                                      SHA512

                                                                                                                                                                      e84acfbe90132674c3c1b8abd573601d37cd6be882c80601a5c4675eb332c20e73723186af471ced333c67de9aed43ca797959f6dc5dc575b76712338c3c8561

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E95C.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      453KB

                                                                                                                                                                      MD5

                                                                                                                                                                      a54b11ad76c698e14478d64391430be7

                                                                                                                                                                      SHA1

                                                                                                                                                                      4aea31ed39f0942b345bed0b6813562d72b6b792

                                                                                                                                                                      SHA256

                                                                                                                                                                      ade40de269f1106cc15af503873ca91733dc4e4173bc7af3448de19435e51fee

                                                                                                                                                                      SHA512

                                                                                                                                                                      5376f01fbfbcb7bb02f4e61c17473bb8c603b00a270a3a48cc0bdb13cf992b33b6d3a5a09f4fb9fb937e25ff40d45b1264b803698298181efcf93e9278b32e16

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E95C.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      453KB

                                                                                                                                                                      MD5

                                                                                                                                                                      a54b11ad76c698e14478d64391430be7

                                                                                                                                                                      SHA1

                                                                                                                                                                      4aea31ed39f0942b345bed0b6813562d72b6b792

                                                                                                                                                                      SHA256

                                                                                                                                                                      ade40de269f1106cc15af503873ca91733dc4e4173bc7af3448de19435e51fee

                                                                                                                                                                      SHA512

                                                                                                                                                                      5376f01fbfbcb7bb02f4e61c17473bb8c603b00a270a3a48cc0bdb13cf992b33b6d3a5a09f4fb9fb937e25ff40d45b1264b803698298181efcf93e9278b32e16

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\EE4F.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      327KB

                                                                                                                                                                      MD5

                                                                                                                                                                      02908ad603f0a72ed2f8e92bf0f2fa76

                                                                                                                                                                      SHA1

                                                                                                                                                                      9df99976acda2ab389e424fc0689d2743e5c291f

                                                                                                                                                                      SHA256

                                                                                                                                                                      ee76f1d57e44116d9b1a2af44182deb6c28cea0d84238453421976999f201cb4

                                                                                                                                                                      SHA512

                                                                                                                                                                      46f4c7d6f7df76391ecaedf9e5865d3c7886312b3c803daf7c84bc1e071f16be9ccf0287ee0cc515bd5e57281d2a926111099a2e6c1b213594147c1772ef483f

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\EE4F.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      327KB

                                                                                                                                                                      MD5

                                                                                                                                                                      02908ad603f0a72ed2f8e92bf0f2fa76

                                                                                                                                                                      SHA1

                                                                                                                                                                      9df99976acda2ab389e424fc0689d2743e5c291f

                                                                                                                                                                      SHA256

                                                                                                                                                                      ee76f1d57e44116d9b1a2af44182deb6c28cea0d84238453421976999f201cb4

                                                                                                                                                                      SHA512

                                                                                                                                                                      46f4c7d6f7df76391ecaedf9e5865d3c7886312b3c803daf7c84bc1e071f16be9ccf0287ee0cc515bd5e57281d2a926111099a2e6c1b213594147c1772ef483f

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\F17C.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      353KB

                                                                                                                                                                      MD5

                                                                                                                                                                      7ed687ac3ea2d88751c61ee4242d2cb1

                                                                                                                                                                      SHA1

                                                                                                                                                                      f4540c03affd6da03d56ebde96b3405877c4339d

                                                                                                                                                                      SHA256

                                                                                                                                                                      4c19c053186dbe91f79872857581e6d7ef3bf1d383b42054e6ede398557e8007

                                                                                                                                                                      SHA512

                                                                                                                                                                      cfa89214d7697471a57ea3aef851250ec3bed42f3daef40d7c976c5ea407a4a5e3ee1d5b22c3e0dc060e02e3fc321f265cca10b1efa15fe4348f0818e6fdb1c6

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\F17C.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      353KB

                                                                                                                                                                      MD5

                                                                                                                                                                      7ed687ac3ea2d88751c61ee4242d2cb1

                                                                                                                                                                      SHA1

                                                                                                                                                                      f4540c03affd6da03d56ebde96b3405877c4339d

                                                                                                                                                                      SHA256

                                                                                                                                                                      4c19c053186dbe91f79872857581e6d7ef3bf1d383b42054e6ede398557e8007

                                                                                                                                                                      SHA512

                                                                                                                                                                      cfa89214d7697471a57ea3aef851250ec3bed42f3daef40d7c976c5ea407a4a5e3ee1d5b22c3e0dc060e02e3fc321f265cca10b1efa15fe4348f0818e6fdb1c6

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\F4F8.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      852KB

                                                                                                                                                                      MD5

                                                                                                                                                                      5a4646dc1e0caa4a0c2da0ddb1c7e97f

                                                                                                                                                                      SHA1

                                                                                                                                                                      bd57414c9549641a54a27cb7868d318689685938

                                                                                                                                                                      SHA256

                                                                                                                                                                      9fe04c781e72a87b131df24fa7f16567fcfe4c16c8e812650e5d583c65e6e3ba

                                                                                                                                                                      SHA512

                                                                                                                                                                      6faf7a612b810595d44bbe8bf0c0637a76794d2831e85e4f0377b6fca0ee5383f364f5b3c0c87dc17d3ac13b7cfc43a738e64bc0fd129fa0921c7d87f0b9b651

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\F4F8.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      852KB

                                                                                                                                                                      MD5

                                                                                                                                                                      5a4646dc1e0caa4a0c2da0ddb1c7e97f

                                                                                                                                                                      SHA1

                                                                                                                                                                      bd57414c9549641a54a27cb7868d318689685938

                                                                                                                                                                      SHA256

                                                                                                                                                                      9fe04c781e72a87b131df24fa7f16567fcfe4c16c8e812650e5d583c65e6e3ba

                                                                                                                                                                      SHA512

                                                                                                                                                                      6faf7a612b810595d44bbe8bf0c0637a76794d2831e85e4f0377b6fca0ee5383f364f5b3c0c87dc17d3ac13b7cfc43a738e64bc0fd129fa0921c7d87f0b9b651

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\F4F8.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      852KB

                                                                                                                                                                      MD5

                                                                                                                                                                      5a4646dc1e0caa4a0c2da0ddb1c7e97f

                                                                                                                                                                      SHA1

                                                                                                                                                                      bd57414c9549641a54a27cb7868d318689685938

                                                                                                                                                                      SHA256

                                                                                                                                                                      9fe04c781e72a87b131df24fa7f16567fcfe4c16c8e812650e5d583c65e6e3ba

                                                                                                                                                                      SHA512

                                                                                                                                                                      6faf7a612b810595d44bbe8bf0c0637a76794d2831e85e4f0377b6fca0ee5383f364f5b3c0c87dc17d3ac13b7cfc43a738e64bc0fd129fa0921c7d87f0b9b651

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\F4F8.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      852KB

                                                                                                                                                                      MD5

                                                                                                                                                                      5a4646dc1e0caa4a0c2da0ddb1c7e97f

                                                                                                                                                                      SHA1

                                                                                                                                                                      bd57414c9549641a54a27cb7868d318689685938

                                                                                                                                                                      SHA256

                                                                                                                                                                      9fe04c781e72a87b131df24fa7f16567fcfe4c16c8e812650e5d583c65e6e3ba

                                                                                                                                                                      SHA512

                                                                                                                                                                      6faf7a612b810595d44bbe8bf0c0637a76794d2831e85e4f0377b6fca0ee5383f364f5b3c0c87dc17d3ac13b7cfc43a738e64bc0fd129fa0921c7d87f0b9b651

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\F4F8.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      852KB

                                                                                                                                                                      MD5

                                                                                                                                                                      5a4646dc1e0caa4a0c2da0ddb1c7e97f

                                                                                                                                                                      SHA1

                                                                                                                                                                      bd57414c9549641a54a27cb7868d318689685938

                                                                                                                                                                      SHA256

                                                                                                                                                                      9fe04c781e72a87b131df24fa7f16567fcfe4c16c8e812650e5d583c65e6e3ba

                                                                                                                                                                      SHA512

                                                                                                                                                                      6faf7a612b810595d44bbe8bf0c0637a76794d2831e85e4f0377b6fca0ee5383f364f5b3c0c87dc17d3ac13b7cfc43a738e64bc0fd129fa0921c7d87f0b9b651

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Wtfoiq.tmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      714KB

                                                                                                                                                                      MD5

                                                                                                                                                                      9dd70d24b2657a9254b9fd536a4d06d5

                                                                                                                                                                      SHA1

                                                                                                                                                                      348a1d210d7c4daef8ecdb692eadf3975971e8ee

                                                                                                                                                                      SHA256

                                                                                                                                                                      d0ac0e9021c6e231c60256198309b7f72ce4c5e772cf343b5456c2ce0664b9bd

                                                                                                                                                                      SHA512

                                                                                                                                                                      dee5bfe83fdf196c78ee255e50a25994220ce9ecac22eb24323df70e668714d7a810b67ddace7809d9d7e2160a35c4603deedb64b1660d82dde58586c34d2ab6

                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Wtfoiq.tmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      714KB

                                                                                                                                                                      MD5

                                                                                                                                                                      9dd70d24b2657a9254b9fd536a4d06d5

                                                                                                                                                                      SHA1

                                                                                                                                                                      348a1d210d7c4daef8ecdb692eadf3975971e8ee

                                                                                                                                                                      SHA256

                                                                                                                                                                      d0ac0e9021c6e231c60256198309b7f72ce4c5e772cf343b5456c2ce0664b9bd

                                                                                                                                                                      SHA512

                                                                                                                                                                      dee5bfe83fdf196c78ee255e50a25994220ce9ecac22eb24323df70e668714d7a810b67ddace7809d9d7e2160a35c4603deedb64b1660d82dde58586c34d2ab6

                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      9KB

                                                                                                                                                                      MD5

                                                                                                                                                                      9ead10c08e72ae41921191f8db39bc16

                                                                                                                                                                      SHA1

                                                                                                                                                                      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                                                                                      SHA256

                                                                                                                                                                      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                                                                                      SHA512

                                                                                                                                                                      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      9KB

                                                                                                                                                                      MD5

                                                                                                                                                                      9ead10c08e72ae41921191f8db39bc16

                                                                                                                                                                      SHA1

                                                                                                                                                                      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                                                                                      SHA256

                                                                                                                                                                      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                                                                                      SHA512

                                                                                                                                                                      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\venuzye.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      4.4MB

                                                                                                                                                                      MD5

                                                                                                                                                                      a571e4d8f9c450f2c256e3ca4ed01f59

                                                                                                                                                                      SHA1

                                                                                                                                                                      acae29d7d8ca985b369525b4defdca4962592b4e

                                                                                                                                                                      SHA256

                                                                                                                                                                      8d7d5abf2d92e4951e29b59140f182c582c335d8957435bea2f539b7ad7a3b0e

                                                                                                                                                                      SHA512

                                                                                                                                                                      068807a6b03b6833e6531e04b4795b95e0c116e494af942bbd88c23abb9c0a22913120aa10ce05d1d81413e474cb64d64512d78a3a2878dacb2d943205cd10b0

                                                                                                                                                                    • \??\c:\users\admin\appdata\local\9d87f84d-b658-43a1-9daf-8de6b126c79b\build2.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      429KB

                                                                                                                                                                      MD5

                                                                                                                                                                      8c14bb1505244971374a88f37a4ec22a

                                                                                                                                                                      SHA1

                                                                                                                                                                      cebd478fd7ca3956c983fb3e33e2cbb7c54fa4d0

                                                                                                                                                                      SHA256

                                                                                                                                                                      f333289bf29805ee697908ecb974aeb81206b471252ec2e51f382d53ac35d962

                                                                                                                                                                      SHA512

                                                                                                                                                                      5e08686f2cbc783716442004d39ee11a4fabec7aaa92f33f758df7861ed0730c211551ecb85dd9dc93c2b83983fc4df08bcfeeb38c9e51bd3dcd138b10cf103e

                                                                                                                                                                    • \??\c:\users\admin\appdata\local\9d87f84d-b658-43a1-9daf-8de6b126c79b\build3.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      9KB

                                                                                                                                                                      MD5

                                                                                                                                                                      9ead10c08e72ae41921191f8db39bc16

                                                                                                                                                                      SHA1

                                                                                                                                                                      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                                                                                      SHA256

                                                                                                                                                                      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                                                                                      SHA512

                                                                                                                                                                      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                                                                                    • \??\c:\users\admin\appdata\roaming\venuzye.exe

                                                                                                                                                                      Filesize

                                                                                                                                                                      4.4MB

                                                                                                                                                                      MD5

                                                                                                                                                                      a571e4d8f9c450f2c256e3ca4ed01f59

                                                                                                                                                                      SHA1

                                                                                                                                                                      acae29d7d8ca985b369525b4defdca4962592b4e

                                                                                                                                                                      SHA256

                                                                                                                                                                      8d7d5abf2d92e4951e29b59140f182c582c335d8957435bea2f539b7ad7a3b0e

                                                                                                                                                                      SHA512

                                                                                                                                                                      068807a6b03b6833e6531e04b4795b95e0c116e494af942bbd88c23abb9c0a22913120aa10ce05d1d81413e474cb64d64512d78a3a2878dacb2d943205cd10b0

                                                                                                                                                                    • memory/720-178-0x0000000005B50000-0x0000000005BE2000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      584KB

                                                                                                                                                                    • memory/720-152-0x0000000004AA0000-0x0000000005044000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      5.6MB

                                                                                                                                                                    • memory/720-179-0x0000000005BF0000-0x0000000005C56000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      408KB

                                                                                                                                                                    • memory/720-159-0x0000000005860000-0x000000000589C000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      240KB

                                                                                                                                                                    • memory/720-158-0x0000000005840000-0x0000000005852000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      72KB

                                                                                                                                                                    • memory/720-157-0x0000000005700000-0x000000000580A000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.0MB

                                                                                                                                                                    • memory/720-199-0x000000000084F000-0x000000000087E000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      188KB

                                                                                                                                                                    • memory/720-200-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      448KB

                                                                                                                                                                    • memory/720-185-0x000000000084F000-0x000000000087E000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      188KB

                                                                                                                                                                    • memory/720-156-0x0000000005090000-0x00000000056A8000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      6.1MB

                                                                                                                                                                    • memory/720-153-0x000000000084F000-0x000000000087E000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      188KB

                                                                                                                                                                    • memory/720-155-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      448KB

                                                                                                                                                                    • memory/720-154-0x00000000007C0000-0x000000000080B000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      300KB

                                                                                                                                                                    • memory/748-167-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/748-169-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/748-172-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/748-174-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/748-181-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/1284-191-0x0000000004CE5000-0x0000000004D76000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      580KB

                                                                                                                                                                    • memory/1416-344-0x00000286CC9E0000-0x00000286CCB20000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/1416-343-0x00000286CC9E0000-0x00000286CCB20000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/1572-164-0x0000000000400000-0x0000000000457000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      348KB

                                                                                                                                                                    • memory/1572-162-0x000000000070E000-0x0000000000724000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      88KB

                                                                                                                                                                    • memory/1572-163-0x00000000005A0000-0x00000000005A9000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      36KB

                                                                                                                                                                    • memory/1572-177-0x0000000000400000-0x0000000000457000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      348KB

                                                                                                                                                                    • memory/1664-309-0x0000000000C60000-0x0000000002284000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      22.1MB

                                                                                                                                                                    • memory/1664-308-0x0000000000C60000-0x0000000002284000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      22.1MB

                                                                                                                                                                    • memory/2100-257-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      384KB

                                                                                                                                                                    • memory/2100-227-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      384KB

                                                                                                                                                                    • memory/2100-255-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      384KB

                                                                                                                                                                    • memory/2100-230-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      384KB

                                                                                                                                                                    • memory/2100-234-0x00000000509B0000-0x0000000050A42000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      584KB

                                                                                                                                                                    • memory/2100-223-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      384KB

                                                                                                                                                                    • memory/2100-225-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      384KB

                                                                                                                                                                    • memory/2280-341-0x0000000005CF0000-0x0000000005E30000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/2280-339-0x0000000005CF0000-0x0000000005E30000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/2280-340-0x0000000005CF0000-0x0000000005E30000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/2280-334-0x0000000004FF0000-0x0000000005B31000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      11.3MB

                                                                                                                                                                    • memory/2280-335-0x0000000005CF0000-0x0000000005E30000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/2280-338-0x0000000005CF0000-0x0000000005E30000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/2280-336-0x0000000005CF0000-0x0000000005E30000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/2532-272-0x00000000040A0000-0x00000000041E0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/2532-274-0x00000000040A0000-0x00000000041E0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/2532-269-0x0000000005E00000-0x0000000006941000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      11.3MB

                                                                                                                                                                    • memory/2532-282-0x0000000005E00000-0x0000000006941000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      11.3MB

                                                                                                                                                                    • memory/2532-270-0x0000000005E00000-0x0000000006941000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      11.3MB

                                                                                                                                                                    • memory/2532-276-0x00000000040A0000-0x00000000041E0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/2532-275-0x00000000040A0000-0x00000000041E0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/2532-271-0x00000000040A0000-0x00000000041E0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/2532-273-0x00000000040A0000-0x00000000041E0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/2768-205-0x00007FFA6DAD0000-0x00007FFA6E591000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      10.8MB

                                                                                                                                                                    • memory/2768-216-0x00007FFA6DAD0000-0x00007FFA6E591000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      10.8MB

                                                                                                                                                                    • memory/2768-204-0x0000000000670000-0x000000000165A000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      15.9MB

                                                                                                                                                                    • memory/2936-303-0x00000000048E0000-0x0000000005421000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      11.3MB

                                                                                                                                                                    • memory/2936-301-0x00000000048E0000-0x0000000005421000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      11.3MB

                                                                                                                                                                    • memory/2936-302-0x00000000048E0000-0x0000000005421000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      11.3MB

                                                                                                                                                                    • memory/3012-228-0x0000000000500000-0x000000000054C000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      304KB

                                                                                                                                                                    • memory/3012-226-0x0000000000588000-0x00000000005B6000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      184KB

                                                                                                                                                                    • memory/3336-278-0x000001F0E98F0000-0x000001F0E9A30000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/3336-283-0x0000000000BE0000-0x0000000000E81000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      2.6MB

                                                                                                                                                                    • memory/3336-279-0x0000000000BE0000-0x0000000000E81000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      2.6MB

                                                                                                                                                                    • memory/3336-280-0x000001F0E98F0000-0x000001F0E9A30000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/3336-281-0x000001F0E7E70000-0x000001F0E8122000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      2.7MB

                                                                                                                                                                    • memory/3576-170-0x0000000003306000-0x0000000003397000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      580KB

                                                                                                                                                                    • memory/3576-173-0x0000000004E40000-0x0000000004F5B000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.1MB

                                                                                                                                                                    • memory/3856-165-0x000000000325D000-0x0000000003272000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      84KB

                                                                                                                                                                    • memory/3856-171-0x0000000000400000-0x000000000301B000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      44.1MB

                                                                                                                                                                    • memory/4064-299-0x0000000003BC0000-0x0000000004701000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      11.3MB

                                                                                                                                                                    • memory/4064-306-0x0000000003BC0000-0x0000000004701000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      11.3MB

                                                                                                                                                                    • memory/4136-133-0x0000000000520000-0x0000000000529000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      36KB

                                                                                                                                                                    • memory/4136-132-0x000000000058E000-0x000000000059E000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      64KB

                                                                                                                                                                    • memory/4136-135-0x0000000000400000-0x000000000045F000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      380KB

                                                                                                                                                                    • memory/4136-134-0x0000000000400000-0x000000000045F000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      380KB

                                                                                                                                                                    • memory/4176-192-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/4176-197-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/4176-229-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/4176-190-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.2MB

                                                                                                                                                                    • memory/4196-296-0x0000000000400000-0x0000000000457000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      348KB

                                                                                                                                                                    • memory/4196-295-0x000000000054E000-0x0000000000564000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      88KB

                                                                                                                                                                    • memory/4332-293-0x000000000059D000-0x00000000005AD000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      64KB

                                                                                                                                                                    • memory/4332-297-0x0000000000400000-0x000000000045F000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      380KB

                                                                                                                                                                    • memory/4332-294-0x0000000000400000-0x000000000045F000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      380KB

                                                                                                                                                                    • memory/4452-268-0x0000000000400000-0x0000000000517000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.1MB

                                                                                                                                                                    • memory/4452-264-0x0000000000400000-0x0000000000517000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.1MB

                                                                                                                                                                    • memory/4452-263-0x0000000002280000-0x0000000002395000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.1MB

                                                                                                                                                                    • memory/4452-262-0x0000000002148000-0x000000000221C000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      848KB

                                                                                                                                                                    • memory/4716-325-0x000001D732DE0000-0x000001D732EE0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1024KB

                                                                                                                                                                    • memory/4716-326-0x000001D735CE0000-0x000001D735D00000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      128KB

                                                                                                                                                                    • memory/4716-327-0x000001D7332B0000-0x000001D7332D0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      128KB

                                                                                                                                                                    • memory/4716-323-0x000001D7333B8000-0x000001D7333C0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      32KB

                                                                                                                                                                    • memory/4716-324-0x000001D7332B0000-0x000001D7332D0000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      128KB

                                                                                                                                                                    • memory/4780-198-0x0000000000400000-0x0000000003034000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      44.2MB

                                                                                                                                                                    • memory/4780-161-0x0000000000400000-0x0000000003034000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      44.2MB

                                                                                                                                                                    • memory/4780-186-0x000000000309D000-0x00000000030CB000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      184KB

                                                                                                                                                                    • memory/4780-184-0x00000000091E0000-0x000000000970C000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      5.2MB

                                                                                                                                                                    • memory/4780-160-0x000000000309D000-0x00000000030CB000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      184KB

                                                                                                                                                                    • memory/4780-183-0x0000000009010000-0x00000000091D2000-memory.dmp

                                                                                                                                                                      Filesize

                                                                                                                                                                      1.8MB