Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    22/01/2023, 03:04

General

  • Target
    6779cd6f17fa7536c4490cc6d72a00a0.exe
  • Size 235KB
  • Sample230122-dklmvafa38
  • SHA256 b00302c7a37d30e1d649945bce637c2be5ef5a1055e572df9866ef8281964b65
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • amadey

Version
  • 3.66

C2
  • 62.204.41.242/9vZbns/index.php

  • 62.204.41.121/ZxhssZx/index.php

  • sysinternals.wf/9djZdj09/index.php

  • msedgewebview2.ru/9djZdj09/index.php

  • allaboutdogstraining.com/9djZdj09/index.php

Extracted

Family
  • redline

Botnet
  • tanos

C2
  • 62.204.41.159:4062

Attributes
  • auth_value

    bcb77cd67cf9918d25e4b6ae210a9305

Extracted

Family
  • redline

Botnet
  • buggy

C2
  • 62.204.41.159:4062

Attributes
  • auth_value

    f3bd7e0e0304fca899cd8bf6146ba4b3

Extracted

Family
  • redline

Botnet
  • temp999

C2
  • 82.115.223.9:15486

Attributes
  • auth_value

    c12cdc1127b45350218306e5550c987e

Extracted

Family
  • redline

Botnet
  • re1

C2
  • librchichelpai.shop:81

  • rniwondunuifac.shop:81

Attributes
  • auth_value

    ed3efbb6da2413ddef90855eed83d6fa

Extracted

Family
  • eternity

C2
  • http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Extracted

Family
  • redline

Botnet
  • @REDLINEVIP Cloud (TG: @FATHEROFCARDERS)

C2
  • 151.80.89.233:13553

Attributes
  • auth_value

    fbee175162920530e6bf470c8003fa1a

Extracted

Family
  • redline

Botnet
  • USA

C2
  • 51.89.199.106:17532

Attributes
  • auth_value

    aba751b988df2fba80def49d4d387792

Extracted

Family
  • redline

Botnet
  • anoNYmoxy

C2
  • 133.130.55.60:24092

Attributes
  • auth_value

    e10c6608b20e74a2f1c64b6d05cde450

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Disables Task Manager via registry modification
  • Downloads MZ/PE file
  • Executes dropped EXE 45 IoCs
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Uses the VBS compiler for execution 1 TTPs
  • Windows security modification 2 TTPs 3 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops desktop.ini file(s) 6 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 7 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 7 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 21 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:884
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {F8CA5333-8156-49AA-8B29-130C8084FA2A} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
          3⤵
            PID:2296
            • C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
              C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
              4⤵
              • Executes dropped EXE
              PID:2484
            • C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe
              C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe
              4⤵
              • Executes dropped EXE
              • Drops desktop.ini file(s)
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:596
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet
                5⤵
                  PID:2944
                  • C:\Windows\SysWOW64\vssadmin.exe
                    vssadmin delete shadows /all /quiet
                    6⤵
                    • Interacts with shadow copies
                    PID:1088
                  • C:\Windows\SysWOW64\chcp.com
                    chcp 65001
                    6⤵
                      PID:1688
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2612
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k WspService
              2⤵
              • Checks processor information in registry
              • Modifies data under HKEY_USERS
              • Modifies registry class
              PID:1556
          • C:\Users\Admin\AppData\Local\Temp\6779cd6f17fa7536c4490cc6d72a00a0.exe
            "C:\Users\Admin\AppData\Local\Temp\6779cd6f17fa7536c4490cc6d72a00a0.exe"
            1⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1844
            • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
              "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe"
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:1488
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe" /F
                3⤵
                • Creates scheduled task(s)
                PID:1464
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1376
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  4⤵
                    PID:1128
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "nbveek.exe" /P "Admin:N"
                    4⤵
                      PID:836
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "nbveek.exe" /P "Admin:R" /E
                      4⤵
                        PID:2008
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        4⤵
                          PID:968
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\4b9a106e76" /P "Admin:N"
                          4⤵
                            PID:1388
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\4b9a106e76" /P "Admin:R" /E
                            4⤵
                              PID:1700
                          • C:\Users\Admin\AppData\Local\Temp\1000003051\lola.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000003051\lola.exe"
                            3⤵
                            • Modifies Windows Defender Real-time Protection settings
                            • Executes dropped EXE
                            • Windows security modification
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1884
                          • C:\Users\Admin\AppData\Local\Temp\1000004001\lola1.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000004001\lola1.exe"
                            3⤵
                            • Modifies Windows Defender Real-time Protection settings
                            • Executes dropped EXE
                            • Windows security modification
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1536
                          • C:\Users\Admin\AppData\Local\Temp\1000005051\nesto1.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000005051\nesto1.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1908
                          • C:\Users\Admin\AppData\Local\Temp\1000006051\tanos.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000006051\tanos.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:688
                          • C:\Users\Admin\AppData\Roaming\1000007000\love1.exe
                            "C:\Users\Admin\AppData\Roaming\1000007000\love1.exe"
                            3⤵
                            • Executes dropped EXE
                            PID:1624
                          • C:\Users\Admin\AppData\Local\Temp\1000009001\stown.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000009001\stown.exe"
                            3⤵
                            • Executes dropped EXE
                            • Modifies system certificate store
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:996
                          • C:\Users\Admin\AppData\Local\Temp\1000010051\nesto.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000010051\nesto.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1128
                          • C:\Users\Admin\AppData\Local\Temp\1000011001\stown3.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000011001\stown3.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1460
                          • C:\Users\Admin\AppData\Local\Temp\1000012001\stown1.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000012001\stown1.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:580
                          • C:\Users\Admin\AppData\Local\Temp\1000014001\love.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000014001\love.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2084
                          • C:\Users\Admin\AppData\Local\Temp\1000016001\legio.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000016001\legio.exe"
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:2272
                            • C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
                              "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe"
                              4⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Adds Run key to start application
                              PID:2320
                              • C:\Windows\SysWOW64\schtasks.exe
                                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe" /F
                                5⤵
                                • Creates scheduled task(s)
                                PID:2360
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\9e0894bcc4" /P "Admin:N"&&CACLS "..\9e0894bcc4" /P "Admin:R" /E&&Exit
                                5⤵
                                  PID:2392
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                    6⤵
                                      PID:2444
                                    • C:\Windows\SysWOW64\cacls.exe
                                      CACLS "nbveek.exe" /P "Admin:N"
                                      6⤵
                                        PID:2456
                                      • C:\Windows\SysWOW64\cacls.exe
                                        CACLS "nbveek.exe" /P "Admin:R" /E
                                        6⤵
                                          PID:2480
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                          6⤵
                                            PID:2500
                                          • C:\Windows\SysWOW64\cacls.exe
                                            CACLS "..\9e0894bcc4" /P "Admin:N"
                                            6⤵
                                              PID:2512
                                            • C:\Windows\SysWOW64\cacls.exe
                                              CACLS "..\9e0894bcc4" /P "Admin:R" /E
                                              6⤵
                                                PID:2528
                                            • C:\Users\Admin\AppData\Local\Temp\1000029001\qiv1ow16wzuw.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1000029001\qiv1ow16wzuw.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:2732
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                6⤵
                                                • Loads dropped DLL
                                                • Accesses Microsoft Outlook profiles
                                                • Checks processor information in registry
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • outlook_office_path
                                                • outlook_win_path
                                                PID:2788
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                                                  7⤵
                                                    PID:3024
                                                    • C:\Windows\SysWOW64\chcp.com
                                                      chcp 65001
                                                      8⤵
                                                        PID:3048
                                                      • C:\Windows\SysWOW64\netsh.exe
                                                        netsh wlan show profile
                                                        8⤵
                                                          PID:3060
                                                        • C:\Windows\SysWOW64\findstr.exe
                                                          findstr All
                                                          8⤵
                                                            PID:1388
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key
                                                          7⤵
                                                            PID:2100
                                                            • C:\Windows\SysWOW64\chcp.com
                                                              chcp 65001
                                                              8⤵
                                                                PID:588
                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                netsh wlan show profile name="65001" key=clear
                                                                8⤵
                                                                  PID:768
                                                                • C:\Windows\SysWOW64\findstr.exe
                                                                  findstr Key
                                                                  8⤵
                                                                    PID:688
                                                                • C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe"
                                                                  7⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:2248
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                  7⤵
                                                                    PID:768
                                                                    • C:\Windows\SysWOW64\chcp.com
                                                                      chcp 65001
                                                                      8⤵
                                                                        PID:848
                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                        ping 127.0.0.1
                                                                        8⤵
                                                                        • Runs ping.exe
                                                                        PID:1184
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 36
                                                                    6⤵
                                                                    • Loads dropped DLL
                                                                    • Program crash
                                                                    PID:2876
                                                                • C:\Users\Admin\AppData\Local\Temp\1000036001\lbcr.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\1000036001\lbcr.exe"
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  PID:1544
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "lbcr" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\1000036001\lbcr.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe"
                                                                    6⤵
                                                                    • Loads dropped DLL
                                                                    PID:996
                                                                    • C:\Windows\SysWOW64\chcp.com
                                                                      chcp 65001
                                                                      7⤵
                                                                        PID:2264
                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                        ping 127.0.0.1
                                                                        7⤵
                                                                        • Runs ping.exe
                                                                        PID:2108
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks /create /tn "lbcr" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe" /rl HIGHEST /f
                                                                        7⤵
                                                                        • Creates scheduled task(s)
                                                                        PID:2284
                                                                      • C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe
                                                                        "C:\Users\Admin\AppData\Local\ServiceHub\lbcr.exe"
                                                                        7⤵
                                                                        • Executes dropped EXE
                                                                        • Modifies extensions of user files
                                                                        • Drops desktop.ini file(s)
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1012
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet
                                                                          8⤵
                                                                            PID:2440
                                                                            • C:\Windows\SysWOW64\chcp.com
                                                                              chcp 65001
                                                                              9⤵
                                                                                PID:2492
                                                                              • C:\Windows\SysWOW64\vssadmin.exe
                                                                                vssadmin delete shadows /all /quiet
                                                                                9⤵
                                                                                • Interacts with shadow copies
                                                                                PID:2220
                                                                      • C:\Users\Admin\AppData\Local\Temp\1000046001\AEZYJkDwVtM76KV.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\1000046001\AEZYJkDwVtM76KV.exe"
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2588
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pZogfgAnxznJd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp83E0.tmp"
                                                                          6⤵
                                                                          • Creates scheduled task(s)
                                                                          PID:560
                                                                        • C:\Users\Admin\AppData\Local\Temp\1000046001\AEZYJkDwVtM76KV.exe
                                                                          "{path}"
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2184
                                                                        • C:\Users\Admin\AppData\Local\Temp\1000046001\AEZYJkDwVtM76KV.exe
                                                                          "{path}"
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          PID:2712
                                                                      • C:\Users\Admin\1000079052\tanos.exe
                                                                        "C:\Users\Admin\1000079052\tanos.exe"
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2716
                                                                      • C:\Users\Admin\1000080052\nesto.exe
                                                                        "C:\Users\Admin\1000080052\nesto.exe"
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3040
                                                                      • C:\Users\Admin\AppData\Local\Temp\1000085001\700K.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\1000085001\700K.exe"
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3060
                                                                      • C:\Users\Admin\AppData\Local\Temp\1000087001\USA.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\1000087001\USA.exe"
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2168
                                                                      • C:\Users\Admin\AppData\Local\Temp\1000096001\svhost.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\1000096001\svhost.exe"
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Adds Run key to start application
                                                                        PID:1460
                                                                        • C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
                                                                          C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          PID:2992
                                                                      • C:\Users\Admin\AppData\Local\Temp\1000107001\Amadey111111.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\1000107001\Amadey111111.exe"
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        PID:2576
                                                                        • C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe"
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Modifies system certificate store
                                                                          PID:2284
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c1e3594748" /P "Admin:N"&&CACLS "..\c1e3594748" /P "Admin:R" /E&&Exit
                                                                            7⤵
                                                                              PID:2776
                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                CACLS "nbveek.exe" /P "Admin:N"
                                                                                8⤵
                                                                                  PID:3052
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                  8⤵
                                                                                    PID:2996
                                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                                    CACLS "nbveek.exe" /P "Admin:R" /E
                                                                                    8⤵
                                                                                      PID:3020
                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                      CACLS "..\c1e3594748" /P "Admin:N"
                                                                                      8⤵
                                                                                        PID:2096
                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                        CACLS "..\c1e3594748" /P "Admin:R" /E
                                                                                        8⤵
                                                                                          PID:524
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                          8⤵
                                                                                            PID:1140
                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\c1e3594748\nbveek.exe" /F
                                                                                          7⤵
                                                                                          • Creates scheduled task(s)
                                                                                          PID:2564
                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000020001\NoNameProc.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\1000020001\NoNameProc.exe"
                                                                                          7⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:2292
                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000021001\msedgewebview2023.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\1000021001\msedgewebview2023.exe"
                                                                                          7⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:2064
                                                                                          • C:\Users\Admin\AppData\Local\Temp\1c19f69719\nbveek.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\1c19f69719\nbveek.exe"
                                                                                            8⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:1544
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\1c19f69719\nbveek.exe" /F
                                                                                              9⤵
                                                                                              • Creates scheduled task(s)
                                                                                              PID:2508
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\1c19f69719" /P "Admin:N"&&CACLS "..\1c19f69719" /P "Admin:R" /E&&Exit
                                                                                              9⤵
                                                                                                PID:2452
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                  10⤵
                                                                                                    PID:996
                                                                                                  • C:\Windows\SysWOW64\cacls.exe
                                                                                                    CACLS "nbveek.exe" /P "Admin:N"
                                                                                                    10⤵
                                                                                                      PID:2740
                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                      CACLS "nbveek.exe" /P "Admin:R" /E
                                                                                                      10⤵
                                                                                                        PID:1968
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                        10⤵
                                                                                                          PID:3008
                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                          CACLS "..\1c19f69719" /P "Admin:N"
                                                                                                          10⤵
                                                                                                            PID:3056
                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                            CACLS "..\1c19f69719" /P "Admin:R" /E
                                                                                                            10⤵
                                                                                                              PID:3068
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000024001\KoverV2_launch.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1000024001\KoverV2_launch.exe"
                                                                                                        7⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:2380
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000024001\KoverV2_launch.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1000024001\KoverV2_launch.exe"
                                                                                                          8⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:1836
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000025001\Lionli.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1000025001\Lionli.exe"
                                                                                                        7⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:2588
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Player3.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Player3.exe"
                                                                                                          8⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:1068
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
                                                                                                            9⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2868
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
                                                                                                              10⤵
                                                                                                              • Creates scheduled task(s)
                                                                                                              PID:2836
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
                                                                                                              10⤵
                                                                                                                PID:1144
                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                  CACLS "nbveek.exe" /P "Admin:N"
                                                                                                                  11⤵
                                                                                                                    PID:3008
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                                    11⤵
                                                                                                                      PID:1968
                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                      CACLS "nbveek.exe" /P "Admin:R" /E
                                                                                                                      11⤵
                                                                                                                        PID:3056
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                                        11⤵
                                                                                                                          PID:3068
                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                          CACLS "..\16de06bfb4" /P "Admin:N"
                                                                                                                          11⤵
                                                                                                                            PID:2144
                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                            CACLS "..\16de06bfb4" /P "Admin:R" /E
                                                                                                                            11⤵
                                                                                                                              PID:1164
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000040001\pb1111.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1000040001\pb1111.exe"
                                                                                                                            10⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:2336
                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 2336 -s 64
                                                                                                                              11⤵
                                                                                                                              • Program crash
                                                                                                                              PID:2068
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1000042001\handdiy_1.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1000042001\handdiy_1.exe"
                                                                                                                            10⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            • Modifies system certificate store
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:2216
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                              11⤵
                                                                                                                                PID:2888
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /f /im chrome.exe
                                                                                                                                  12⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:2248
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                11⤵
                                                                                                                                  PID:2304
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5824f50,0x7fef5824f60,0x7fef5824f70
                                                                                                                                    12⤵
                                                                                                                                      PID:2812
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1000043001\random.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1000043001\random.exe"
                                                                                                                                  10⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:2996
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1000043001\random.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1000043001\random.exe" -h
                                                                                                                                    11⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:2960
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfwang.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\jfwang.exe"
                                                                                                                              8⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:2356
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfwang.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\jfwang.exe" -h
                                                                                                                                9⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Modifies system certificate store
                                                                                                                                PID:2780
                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main
                                                                                                                              8⤵
                                                                                                                                PID:2628
                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 2628 -s 344
                                                                                                                                  9⤵
                                                                                                                                  • Program crash
                                                                                                                                  PID:1708
                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main
                                                                                                                              7⤵
                                                                                                                                PID:2548
                                                                                                                                • C:\Windows\system32\rundll32.exe
                                                                                                                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main
                                                                                                                                  8⤵
                                                                                                                                    PID:2132
                                                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                                                      C:\Windows\system32\WerFault.exe -u -p 2132 -s 344
                                                                                                                                      9⤵
                                                                                                                                      • Program crash
                                                                                                                                      PID:2084
                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main
                                                                                                                                  7⤵
                                                                                                                                    PID:2716
                                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main
                                                                                                                                      8⤵
                                                                                                                                        PID:1152
                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 1152 -s 344
                                                                                                                                          9⤵
                                                                                                                                          • Program crash
                                                                                                                                          PID:2744
                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\cred64.dll, Main
                                                                                                                                      7⤵
                                                                                                                                        PID:2588
                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\clip64.dll, Main
                                                                                                                                        7⤵
                                                                                                                                          PID:1564
                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\clip64.dll, Main
                                                                                                                                          7⤵
                                                                                                                                            PID:2228
                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\55b408a629a8dd\clip64.dll, Main
                                                                                                                                            7⤵
                                                                                                                                              PID:2100
                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                                                                                                                          5⤵
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          PID:2188
                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                                                                                                                                            6⤵
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            PID:2240
                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 2240 -s 344
                                                                                                                                              7⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Program crash
                                                                                                                                              PID:2204
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1000017051\tanos1.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1000017051\tanos1.exe"
                                                                                                                                      3⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:2624
                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                                                                                                                      3⤵
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      PID:2424
                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                                                                                                                        4⤵
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        PID:2540
                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 2540 -s 344
                                                                                                                                          5⤵
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Program crash
                                                                                                                                          PID:2428
                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                                                                                                                                      3⤵
                                                                                                                                        PID:2524
                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                                                                                    1⤵
                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                    PID:2436
                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                                                                                      2⤵
                                                                                                                                      • Modifies registry class
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:2304
                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                                                                                    1⤵
                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                    PID:1448
                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                                                                                      2⤵
                                                                                                                                      • Modifies registry class
                                                                                                                                      PID:2152

                                                                                                                                  Network

                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        lola.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000003051\lola.exe
                                                                                                                                        • Size 11KB
                                                                                                                                        • SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        lola.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000003051\lola.exe
                                                                                                                                        • Size 11KB
                                                                                                                                        • SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        lola1.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000004001\lola1.exe
                                                                                                                                        • Size 11KB
                                                                                                                                        • SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        lola1.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000004001\lola1.exe
                                                                                                                                        • Size 11KB
                                                                                                                                        • SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        nesto1.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000005051\nesto1.exe
                                                                                                                                        • Size 305KB
                                                                                                                                        • SHA256 b1b3135edb99cf981f38262f62a7bffcd60a22230cc1c5c0ff34e64389160423
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        tanos.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000006051\tanos.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 f3bba4b243aafa14e55ebea622e10b30591d46538f9bd88f7360f45f7b2f4bf2
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        tanos.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000006051\tanos.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 f3bba4b243aafa14e55ebea622e10b30591d46538f9bd88f7360f45f7b2f4bf2
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        stown.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000009001\stown.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 f2c8e305017b517b148ab331202abb26fe518779f2630926ceaf48ccf7c4d795
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        stown.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000009001\stown.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 f2c8e305017b517b148ab331202abb26fe518779f2630926ceaf48ccf7c4d795
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        nesto.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000010051\nesto.exe
                                                                                                                                        • Size 305KB
                                                                                                                                        • SHA256 b1b3135edb99cf981f38262f62a7bffcd60a22230cc1c5c0ff34e64389160423
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        stown3.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000011001\stown3.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 22363b9b60f638b72c1f6b12d9ee1d8046fc208247fbde7ab7ac144bf489e415
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        stown3.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000011001\stown3.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 22363b9b60f638b72c1f6b12d9ee1d8046fc208247fbde7ab7ac144bf489e415
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        stown1.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000012001\stown1.exe
                                                                                                                                        • Size 3.4MB
                                                                                                                                        • SHA256 960adba1385780365bed7eded36309aba3f0fa281f304900abd1e381a3f78fbe
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        love.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000014001\love.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 3aa8e492247c9bc7c9a3dec184e09cc407bbc98683d9646ed984a372fd0958a9
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        love.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000014001\love.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 3aa8e492247c9bc7c9a3dec184e09cc407bbc98683d9646ed984a372fd0958a9
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        legio.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000016001\legio.exe
                                                                                                                                        • Size 235KB
                                                                                                                                        • SHA256 2c25b70f08a34cc52989882c4715854c4f488dacfa2c4a615ce5f8c265b21862
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        legio.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000016001\legio.exe
                                                                                                                                        • Size 235KB
                                                                                                                                        • SHA256 2c25b70f08a34cc52989882c4715854c4f488dacfa2c4a615ce5f8c265b21862
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        tanos1.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000017051\tanos1.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 f3bba4b243aafa14e55ebea622e10b30591d46538f9bd88f7360f45f7b2f4bf2
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        tanos1.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000017051\tanos1.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 f3bba4b243aafa14e55ebea622e10b30591d46538f9bd88f7360f45f7b2f4bf2
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        qiv1ow16wzuw.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\1000029001\qiv1ow16wzuw.exe
                                                                                                                                        • Size 667KB
                                                                                                                                        • SHA256 156da573614eadb656348d9ac7af4de07134dd7e1f66cb2df40260a830b7b520
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        nbveek.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
                                                                                                                                        • Size 235KB
                                                                                                                                        • SHA256 b00302c7a37d30e1d649945bce637c2be5ef5a1055e572df9866ef8281964b65
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        nbveek.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
                                                                                                                                        • Size 235KB
                                                                                                                                        • SHA256 b00302c7a37d30e1d649945bce637c2be5ef5a1055e572df9866ef8281964b65
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        nbveek.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
                                                                                                                                        • Size 235KB
                                                                                                                                        • SHA256 2c25b70f08a34cc52989882c4715854c4f488dacfa2c4a615ce5f8c265b21862
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        nbveek.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
                                                                                                                                        • Size 235KB
                                                                                                                                        • SHA256 2c25b70f08a34cc52989882c4715854c4f488dacfa2c4a615ce5f8c265b21862
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        nbveek.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
                                                                                                                                        • Size 235KB
                                                                                                                                        • SHA256 2c25b70f08a34cc52989882c4715854c4f488dacfa2c4a615ce5f8c265b21862
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        libcrypto-1_1.dll

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Tor\libcrypto-1_1.dll
                                                                                                                                        • Size 3.5MB
                                                                                                                                        • SHA256 e4b6b2ca32b1e2ba26959ec7380c4f117418d3a724f60494ff3cb81505fbf43d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        libevent-2-1-7.dll

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Tor\libevent-2-1-7.dll
                                                                                                                                        • Size 1.1MB
                                                                                                                                        • SHA256 91c812a33871e40b264761f1418e37ebfeb750fe61ca00cbcbe9f3769a8bf585
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        libgcc_s_sjlj-1.dll

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Tor\libgcc_s_sjlj-1.dll
                                                                                                                                        • Size 1.0MB
                                                                                                                                        • SHA256 ebda776a2a353f8f0690b1c7706b0cdaff3d23e1618515d45e451fc19440501c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        libssl-1_1.dll

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Tor\libssl-1_1.dll
                                                                                                                                        • Size 1.1MB
                                                                                                                                        • SHA256 e6f4cf41373e8770c670cf5e85461f25385314ed9d8a2b37381bc84f5c0dd5c0
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        libssp-0.dll

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Tor\libssp-0.dll
                                                                                                                                        • Size 246KB
                                                                                                                                        • SHA256 46541d9e28c18bc11267630920b97c42f104c258b55e2f62e4a02bcd5f03e0e7
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        libwinpthread-1.dll

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Tor\libwinpthread-1.dll
                                                                                                                                        • Size 512KB
                                                                                                                                        • SHA256 228fcfe9ed0574b8da32dd26eaf2f5dbaef0e1bd2535cb9b1635212ccdcbf84d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        tor.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Tor\tor.exe
                                                                                                                                        • Size 4.0MB
                                                                                                                                        • SHA256 f0aaae0364306bb7a4681d01935c96c2ac76b3576b7982990f86bcaf811a45ba
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        zlib1.dll

                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Tor\zlib1.dll
                                                                                                                                        • Size 121KB
                                                                                                                                        • SHA256 219d9d5bf0de4c2251439c89dd5f2959ee582e7f9f7d5ff66a29c88753a3a773
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        love1.exe

                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\1000007000\love1.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 3aa8e492247c9bc7c9a3dec184e09cc407bbc98683d9646ed984a372fd0958a9
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        lola.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000003051\lola.exe
                                                                                                                                        • Size 11KB
                                                                                                                                        • SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        lola1.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000004001\lola1.exe
                                                                                                                                        • Size 11KB
                                                                                                                                        • SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        nesto1.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000005051\nesto1.exe
                                                                                                                                        • Size 305KB
                                                                                                                                        • SHA256 b1b3135edb99cf981f38262f62a7bffcd60a22230cc1c5c0ff34e64389160423
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        nesto1.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000005051\nesto1.exe
                                                                                                                                        • Size 305KB
                                                                                                                                        • SHA256 b1b3135edb99cf981f38262f62a7bffcd60a22230cc1c5c0ff34e64389160423
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        tanos.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000006051\tanos.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 f3bba4b243aafa14e55ebea622e10b30591d46538f9bd88f7360f45f7b2f4bf2
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        stown.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000009001\stown.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 f2c8e305017b517b148ab331202abb26fe518779f2630926ceaf48ccf7c4d795
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        nesto.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000010051\nesto.exe
                                                                                                                                        • Size 305KB
                                                                                                                                        • SHA256 b1b3135edb99cf981f38262f62a7bffcd60a22230cc1c5c0ff34e64389160423
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        nesto.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000010051\nesto.exe
                                                                                                                                        • Size 305KB
                                                                                                                                        • SHA256 b1b3135edb99cf981f38262f62a7bffcd60a22230cc1c5c0ff34e64389160423
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        stown3.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000011001\stown3.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 22363b9b60f638b72c1f6b12d9ee1d8046fc208247fbde7ab7ac144bf489e415
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        stown1.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000012001\stown1.exe
                                                                                                                                        • Size 3.4MB
                                                                                                                                        • SHA256 960adba1385780365bed7eded36309aba3f0fa281f304900abd1e381a3f78fbe
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        love.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000014001\love.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 3aa8e492247c9bc7c9a3dec184e09cc407bbc98683d9646ed984a372fd0958a9
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        legio.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000016001\legio.exe
                                                                                                                                        • Size 235KB
                                                                                                                                        • SHA256 2c25b70f08a34cc52989882c4715854c4f488dacfa2c4a615ce5f8c265b21862
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        tanos1.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000017051\tanos1.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 f3bba4b243aafa14e55ebea622e10b30591d46538f9bd88f7360f45f7b2f4bf2
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        qiv1ow16wzuw.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000029001\qiv1ow16wzuw.exe
                                                                                                                                        • Size 667KB
                                                                                                                                        • SHA256 156da573614eadb656348d9ac7af4de07134dd7e1f66cb2df40260a830b7b520
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        qiv1ow16wzuw.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000029001\qiv1ow16wzuw.exe
                                                                                                                                        • Size 667KB
                                                                                                                                        • SHA256 156da573614eadb656348d9ac7af4de07134dd7e1f66cb2df40260a830b7b520
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        qiv1ow16wzuw.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000029001\qiv1ow16wzuw.exe
                                                                                                                                        • Size 667KB
                                                                                                                                        • SHA256 156da573614eadb656348d9ac7af4de07134dd7e1f66cb2df40260a830b7b520
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        qiv1ow16wzuw.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000029001\qiv1ow16wzuw.exe
                                                                                                                                        • Size 667KB
                                                                                                                                        • SHA256 156da573614eadb656348d9ac7af4de07134dd7e1f66cb2df40260a830b7b520
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        qiv1ow16wzuw.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\1000029001\qiv1ow16wzuw.exe
                                                                                                                                        • Size 667KB
                                                                                                                                        • SHA256 156da573614eadb656348d9ac7af4de07134dd7e1f66cb2df40260a830b7b520
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        nbveek.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\4b9a106e76\nbveek.exe
                                                                                                                                        • Size 235KB
                                                                                                                                        • SHA256 b00302c7a37d30e1d649945bce637c2be5ef5a1055e572df9866ef8281964b65
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        nbveek.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\9e0894bcc4\nbveek.exe
                                                                                                                                        • Size 235KB
                                                                                                                                        • SHA256 2c25b70f08a34cc52989882c4715854c4f488dacfa2c4a615ce5f8c265b21862
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        libcrypto-1_1.dll

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\Tor\libcrypto-1_1.dll
                                                                                                                                        • Size 3.5MB
                                                                                                                                        • SHA256 e4b6b2ca32b1e2ba26959ec7380c4f117418d3a724f60494ff3cb81505fbf43d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        libevent-2-1-7.dll

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\Tor\libevent-2-1-7.dll
                                                                                                                                        • Size 1.1MB
                                                                                                                                        • SHA256 91c812a33871e40b264761f1418e37ebfeb750fe61ca00cbcbe9f3769a8bf585
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        libgcc_s_sjlj-1.dll

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\Tor\libgcc_s_sjlj-1.dll
                                                                                                                                        • Size 1.0MB
                                                                                                                                        • SHA256 ebda776a2a353f8f0690b1c7706b0cdaff3d23e1618515d45e451fc19440501c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        libssl-1_1.dll

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\Tor\libssl-1_1.dll
                                                                                                                                        • Size 1.1MB
                                                                                                                                        • SHA256 e6f4cf41373e8770c670cf5e85461f25385314ed9d8a2b37381bc84f5c0dd5c0
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        libssp-0.dll

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\Tor\libssp-0.dll
                                                                                                                                        • Size 246KB
                                                                                                                                        • SHA256 46541d9e28c18bc11267630920b97c42f104c258b55e2f62e4a02bcd5f03e0e7
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        libwinpthread-1.dll

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\Tor\libwinpthread-1.dll
                                                                                                                                        • Size 512KB
                                                                                                                                        • SHA256 228fcfe9ed0574b8da32dd26eaf2f5dbaef0e1bd2535cb9b1635212ccdcbf84d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        tor.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\Tor\tor.exe
                                                                                                                                        • Size 4.0MB
                                                                                                                                        • SHA256 f0aaae0364306bb7a4681d01935c96c2ac76b3576b7982990f86bcaf811a45ba
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        tor.exe

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\Tor\tor.exe
                                                                                                                                        • Size 4.0MB
                                                                                                                                        • SHA256 f0aaae0364306bb7a4681d01935c96c2ac76b3576b7982990f86bcaf811a45ba
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        zlib1.dll

                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\Tor\zlib1.dll
                                                                                                                                        • Size 121KB
                                                                                                                                        • SHA256 219d9d5bf0de4c2251439c89dd5f2959ee582e7f9f7d5ff66a29c88753a3a773
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        love1.exe

                                                                                                                                        • Path \Users\Admin\AppData\Roaming\1000007000\love1.exe
                                                                                                                                        • Size 175KB
                                                                                                                                        • SHA256 3aa8e492247c9bc7c9a3dec184e09cc407bbc98683d9646ed984a372fd0958a9
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP

                                                                                                                                        memory/580-124-0x00000000022F0000-0x0000000002322000-memory.dmp

                                                                                                                                        memory/580-123-0x00000000022C0000-0x00000000022F4000-memory.dmp

                                                                                                                                        memory/580-120-0x0000000000400000-0x0000000000920000-memory.dmp

                                                                                                                                        memory/596-299-0x00000000050B6000-0x00000000050C7000-memory.dmp

                                                                                                                                        memory/688-87-0x0000000000A30000-0x0000000000A62000-memory.dmp

                                                                                                                                        memory/996-101-0x0000000000D60000-0x0000000000D92000-memory.dmp

                                                                                                                                        memory/1012-271-0x0000000000300000-0x00000000003A0000-memory.dmp

                                                                                                                                        memory/1012-256-0x0000000000300000-0x00000000003A0000-memory.dmp

                                                                                                                                        memory/1012-236-0x00000000000D0000-0x00000000000F2000-memory.dmp

                                                                                                                                        memory/1128-114-0x0000000004720000-0x0000000004766000-memory.dmp

                                                                                                                                        memory/1128-152-0x0000000002CFE000-0x0000000002D2C000-memory.dmp

                                                                                                                                        memory/1128-153-0x0000000000400000-0x0000000002BB6000-memory.dmp

                                                                                                                                        memory/1128-115-0x0000000002CFE000-0x0000000002D2C000-memory.dmp

                                                                                                                                        memory/1128-116-0x0000000000400000-0x0000000002BB6000-memory.dmp

                                                                                                                                        memory/1460-293-0x0000000000400000-0x0000000000803000-memory.dmp

                                                                                                                                        memory/1460-288-0x0000000000400000-0x0000000000803000-memory.dmp

                                                                                                                                        memory/1460-258-0x0000000002320000-0x00000000024CA000-memory.dmp

                                                                                                                                        memory/1460-263-0x0000000000400000-0x0000000000803000-memory.dmp

                                                                                                                                        memory/1460-262-0x00000000024D0000-0x00000000028A0000-memory.dmp

                                                                                                                                        memory/1460-261-0x0000000002320000-0x00000000024CA000-memory.dmp

                                                                                                                                        memory/1460-112-0x00000000003D0000-0x0000000000402000-memory.dmp

                                                                                                                                        memory/1536-77-0x0000000000260000-0x000000000026A000-memory.dmp

                                                                                                                                        memory/1544-291-0x0000000000230000-0x000000000026F000-memory.dmp

                                                                                                                                        memory/1544-306-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                                                                                        memory/1544-305-0x000000000065C000-0x000000000067B000-memory.dmp

                                                                                                                                        memory/1544-226-0x0000000000AC0000-0x0000000000AE2000-memory.dmp

                                                                                                                                        memory/1544-294-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                                                                                        memory/1544-290-0x000000000065C000-0x000000000067B000-memory.dmp

                                                                                                                                        memory/1556-312-0x0000000000060000-0x00000000000AD000-memory.dmp

                                                                                                                                        memory/1556-313-0x0000000000470000-0x00000000004E2000-memory.dmp

                                                                                                                                        memory/1844-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

                                                                                                                                        memory/1884-72-0x0000000000E70000-0x0000000000E7A000-memory.dmp

                                                                                                                                        memory/1908-91-0x0000000002C8E000-0x0000000002CBC000-memory.dmp

                                                                                                                                        memory/1908-88-0x0000000004860000-0x00000000048A6000-memory.dmp

                                                                                                                                        memory/1908-93-0x0000000000400000-0x0000000002BB6000-memory.dmp

                                                                                                                                        memory/1908-89-0x00000000048A0000-0x00000000048E4000-memory.dmp

                                                                                                                                        memory/1908-132-0x0000000002C8E000-0x0000000002CBC000-memory.dmp

                                                                                                                                        memory/1908-133-0x0000000000400000-0x0000000002BB6000-memory.dmp

                                                                                                                                        memory/1908-92-0x00000000002E0000-0x000000000032B000-memory.dmp

                                                                                                                                        memory/2064-285-0x00000000008CC000-0x00000000008EB000-memory.dmp

                                                                                                                                        memory/2064-287-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                                                                                        memory/2064-286-0x00000000003C0000-0x00000000003FF000-memory.dmp

                                                                                                                                        memory/2084-130-0x00000000012B0000-0x00000000012E2000-memory.dmp

                                                                                                                                        memory/2168-251-0x0000000001350000-0x0000000001382000-memory.dmp

                                                                                                                                        memory/2184-278-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                                                                                        memory/2184-282-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                                                                                        memory/2184-272-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                                                                                        memory/2184-273-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                                                                                        memory/2184-275-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                                                                                        memory/2184-277-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                                                                                        memory/2184-280-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                                                                                        memory/2248-244-0x00000000003B0000-0x00000000007C3000-memory.dmp

                                                                                                                                        memory/2248-221-0x0000000069A70000-0x0000000069D65000-memory.dmp

                                                                                                                                        memory/2248-211-0x00000000003B0000-0x00000000007C3000-memory.dmp

                                                                                                                                        memory/2248-219-0x0000000069E80000-0x0000000069F7B000-memory.dmp

                                                                                                                                        memory/2248-298-0x00000000003B0000-0x00000000007C3000-memory.dmp

                                                                                                                                        memory/2248-223-0x000000006BB40000-0x000000006BB66000-memory.dmp

                                                                                                                                        memory/2248-222-0x0000000069980000-0x0000000069A66000-memory.dmp

                                                                                                                                        memory/2248-210-0x000000006BB40000-0x000000006BB66000-memory.dmp

                                                                                                                                        memory/2248-208-0x0000000069E80000-0x0000000069F7B000-memory.dmp

                                                                                                                                        memory/2248-224-0x00000000003B0000-0x00000000007C3000-memory.dmp

                                                                                                                                        memory/2304-309-0x00000000009F0000-0x0000000000AF1000-memory.dmp

                                                                                                                                        memory/2304-311-0x0000000000320000-0x000000000037E000-memory.dmp

                                                                                                                                        memory/2588-300-0x0000000000100000-0x000000000016E000-memory.dmp

                                                                                                                                        memory/2588-270-0x00000000007E0000-0x0000000000812000-memory.dmp

                                                                                                                                        memory/2588-269-0x0000000005170000-0x00000000051E2000-memory.dmp

                                                                                                                                        memory/2588-232-0x0000000000C30000-0x0000000000CEE000-memory.dmp

                                                                                                                                        memory/2588-241-0x00000000003F0000-0x00000000003FE000-memory.dmp

                                                                                                                                        memory/2624-158-0x00000000000B0000-0x00000000000E2000-memory.dmp

                                                                                                                                        memory/2716-239-0x0000000000DE0000-0x0000000000E12000-memory.dmp

                                                                                                                                        memory/2788-164-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                                                        memory/2788-166-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                                                        memory/2788-173-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                                                        memory/2788-172-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                                                        memory/2992-296-0x0000000002270000-0x000000000241A000-memory.dmp

                                                                                                                                        memory/2992-292-0x0000000002270000-0x000000000241A000-memory.dmp

                                                                                                                                        memory/2992-297-0x0000000000400000-0x0000000000803000-memory.dmp

                                                                                                                                        memory/3040-248-0x0000000002D0E000-0x0000000002D3C000-memory.dmp

                                                                                                                                        memory/3040-249-0x0000000000400000-0x0000000002BB6000-memory.dmp

                                                                                                                                        memory/3040-267-0x0000000000400000-0x0000000002BB6000-memory.dmp

                                                                                                                                        memory/3040-266-0x0000000002D0E000-0x0000000002D3C000-memory.dmp

                                                                                                                                        memory/3060-246-0x0000000001140000-0x0000000001172000-memory.dmp