Resubmissions

14-02-2023 04:33

230214-e6z8ssab4w 10

10-02-2023 07:04

230210-hv9vmsgg96 10

10-02-2023 06:59

230210-hsg2vage79 10

10-02-2023 06:49

230210-hlmzhsfe71 10

10-02-2023 06:42

230210-hgvtkaff86 10

09-02-2023 14:35

230209-rx1jesfg53 10

Analysis

  • max time kernel
    519s
  • max time network
    467s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-es
  • resource tags

    arch:x64arch:x86image:win10-20220901-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    10-02-2023 07:04

General

  • Target

    2023-02-08_69d6f75b8cfd52216a6ff4b0861655ef_neshta_revil_sodinokibi.exe

  • Size

    219KB

  • MD5

    69d6f75b8cfd52216a6ff4b0861655ef

  • SHA1

    2c644dac27af557bc1a8329baf943e8b81170b2e

  • SHA256

    349bdb12a75fbfc2803f988862764ba6058b371728930f8dcb248f105ce607f7

  • SHA512

    48ab4714e8ee1a0f7327160ebeacae22a31efc24fd89822521d5fff0c44fbb814646457cb8eda9429316102982f13bdd0f29f4189902e7a3e7ecfd3c055035fa

  • SSDEEP

    3072:ur85Ce8F63VETed7/kBazzFbULpC15RM4ENKQ4JTBg0D:u9eS63VE6F/M4qE15NENn4FD

Malware Config

Extracted

Path

C:\l1uau-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion l1uau. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7ACBB3125E3C5BEB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/7ACBB3125E3C5BEB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9IskJbzo/yIebbC8kbOmuUMq8fs0f5OpW8fK+sImQFkXvc5LUU8STlSHczpgNuXw XEixkIoWvxxOoYeg7I2E3rimvQvncStUxfNAbc86GNeLNdp3lNYbh/8j9FILjdZc n/fzJar2RdgIB7kMWxKoo/ZXQu1TaUKKOdOymoJI8LJi+YP9I9t6tNUdbP+EpayI Oh1Uq/7t+lC4fKEruSA2exA9zwXo8ydgb3w0qqg4P4X1cnTJAEvyOYMSlg0bBhoW /zH3hxwiBHGE1Ep6xrQZKsfyKKd3jDoaFjQ3lU4djdvDnFy2nWmxfVZhPA6mkIsE te5Sq92KLOIHqwep0F2U+4DBY6AD8iGKXe672IE2dscRpklM/MOBgI3SVtwg6qei 2ymD+NmLRDQ8/RQuhXft7Tr/sO5fsj71zAvFanFWYWWxvE5tn2NGRR2NtJzMitZc Gwy36gUmUv9XOtxmcx0RzuvjlaS8GpWjEGB0Y6gR2PQjJd6WUj6gaBfJJCH3pQS4 GwI+cRTV1jIJdTc/TAD1eEfsdBi++4LQGellMywyEjGpKNIXXL0+Z05xFP9XiAAV Yn8tYqV3LXm4TgRT/+qxYBpqhRNJLzQwJypm7WxoFeOeO5TVkIjylJSzfbM12/Bn 8gXg/kXsHqby7aXO38sO0ZUHM9HPTqLU1A+tUnurb3L48e1tWMCrmfTTXr54xCGW ToN6gXYn5g18dUVjrShvWmaqnnwyrjsi9w8ES7T67EKLnQbIqRzPrPG/6Tkork7Y tm2TLjUsmig0NIYzBvIIn58m9TQFeYy5xKp9sN7o1CPfmj6oXKnQHKl/k0tHiFxp CKaWcUNkgA/p4UV7kOEX65a1dEel/lB3//tUIKa90OZOXjHJ0WjU5wfOnU/o8Wf5 tSo2j/TG20MjTgwgOrN4XfUAHnKixGH2tPkTSgNTAlbR8rY3/XSr5r6u8kvgC1i7 29SJNJfSHjn3dS9yuP3O1/M+0o8lDvHtQzSIYrVQXrZ8orRU/LS9SKdXJyeGahIQ WkVtqbtv1ifiyD13PjGIku+17l7iTydnJUarb3PGMpB6SWFEnNgAzaiQWQotlPKt jJCWa6FkrZUT+zZZqD+4ucJZicGeTd66sdrPJ/85GZz2ePdpMDQ= Extension name: l1uau ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7ACBB3125E3C5BEB

http://decryptor.top/7ACBB3125E3C5BEB

Extracted

Family

sodinokibi

Botnet

19

Campaign

96

Decoy

speiserei-hannover.de

delegationhub.com

subyard.com

martha-frets-ceramics.nl

hostastay.com

luvbec.com

dayenne-styling.nl

111firstdelray.com

lidkopingsnytt.nu

fbmagazine.ru

peppergreenfarmcatering.com.au

ya-elka.ru

mundo-pieces-auto.fr

mediabolmong.com

yuanshenghotel.com

fidelitytitleoregon.com

penumbuhrambutkeiskei.com

2020hindsight.info

aslog.fr

teethinadaydentalimplants.com

Attributes
  • net

    true

  • pid

    19

  • prc

    tbirdconfig

    onenote

    sqlbrowser

    firefoxconfig

    ocautoupds

    ocssd

    thebat

    winword

    mspub

    dbeng50

    steam

    sqlwriter

    sqlservr

    msftesql

    encsvc

    infopath

    mysqld_nt

    sqlagent

    mydesktopqos

    synctime

    wordpad

    powerpnt

    outlook

    dbsnmp

    isqlplussvc

    ocomm

    sqbcoreservice

    oracle

    thunderbird

    xfssvccon

    excel

    mydesktopservice

    msaccess

    mysqld_opt

    mysqld

    agntsvc

    thebat64

    visio

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    96

  • svc

    veeam

    backup

    sql

    mepocs

    sophos

    svc$

    vss

    memtas

Signatures

  • Detect Neshta payload 46 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

  • Sodinokibi/Revil sample 2 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 26 IoCs
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies Internet Explorer settings 1 TTPs 46 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 42 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-02-08_69d6f75b8cfd52216a6ff4b0861655ef_neshta_revil_sodinokibi.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-02-08_69d6f75b8cfd52216a6ff4b0861655ef_neshta_revil_sodinokibi.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2023-02-08_69d6f75b8cfd52216a6ff4b0861655ef_neshta_revil_sodinokibi.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2023-02-08_69d6f75b8cfd52216a6ff4b0861655ef_neshta_revil_sodinokibi.exe"
      2⤵
      • Modifies extensions of user files
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Sets desktop wallpaper using registry
      • Drops file in Program Files directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3636
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4844
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\System32\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4360
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin.exe Delete Shadows /All /Quiet
            5⤵
            • Interacts with shadow copies
            PID:4676
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4544
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4144
    • C:\Program Files\Windows Mail\wab.exe
      "C:\Program Files\Windows Mail\wab.exe" /contact "C:\Users\Admin\Desktop\SetReceive.contact"
      1⤵
        PID:2128
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2648
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
        • Modifies Internet Explorer settings
        PID:2316
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3504
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:1344
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:3560
      • C:\Windows\System32\notepad.exe
        "C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\ExportRestart.ps1"
        1⤵
        • Opens file in notepad (likely ransom note)
        PID:1276
      • C:\Program Files\Windows Mail\wab.exe
        "C:\Program Files\Windows Mail\wab.exe" /contact "C:\Users\Admin\Desktop\SetReceive.contact"
        1⤵
          PID:4400
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RenameClose.gif
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4348
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4348 CREDAT:82945 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:4716
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4184
          • C:\Windows\system32\dashost.exe
            dashost.exe {dc77ef7c-e127-4ad8-8dd78579b8371a14}
            2⤵
              PID:4556
          • C:\Windows\system32\OpenWith.exe
            C:\Windows\system32\OpenWith.exe -Embedding
            1⤵
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4360
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\RenameClose.gif"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3420
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -url C:\Users\Admin\Desktop\RenameClose.gif
                3⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1544
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1544.0.1098629275\1635219366" -parentBuildID 20200403170909 -prefsHandle 1544 -prefMapHandle 1536 -prefsLen 1 -prefMapSize 219987 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1544 "\\.\pipe\gecko-crash-server-pipe.1544" 1616 gpu
                  4⤵
                    PID:1548
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1544.3.601009008\604452957" -childID 1 -isForBrowser -prefsHandle 2208 -prefMapHandle 2120 -prefsLen 156 -prefMapSize 219987 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1544 "\\.\pipe\gecko-crash-server-pipe.1544" 2228 tab
                    4⤵
                      PID:4004
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1544.13.1005025618\1726196794" -childID 2 -isForBrowser -prefsHandle 3312 -prefMapHandle 3272 -prefsLen 6938 -prefMapSize 219987 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1544 "\\.\pipe\gecko-crash-server-pipe.1544" 3284 tab
                      4⤵
                        PID:1576
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1544.20.187962951\240577188" -childID 3 -isForBrowser -prefsHandle 4144 -prefMapHandle 4140 -prefsLen 7643 -prefMapSize 219987 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1544 "\\.\pipe\gecko-crash-server-pipe.1544" 4152 tab
                        4⤵
                          PID:5064
                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                    1⤵
                    • Drops file in Windows directory
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:2464
                  • C:\Windows\system32\browser_broker.exe
                    C:\Windows\system32\browser_broker.exe -Embedding
                    1⤵
                    • Modifies Internet Explorer settings
                    PID:2960
                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                    1⤵
                    • Modifies registry class
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of SetWindowsHookEx
                    PID:1936
                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                    1⤵
                    • Drops file in Windows directory
                    • Modifies registry class
                    PID:5060
                  • C:\Windows\system32\mspaint.exe
                    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\StopDismount.rle"
                    1⤵
                    • Drops file in Windows directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:4160
                  • \??\c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
                    1⤵
                      PID:872
                    • C:\Windows\system32\NOTEPAD.EXE
                      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\UpdateNew.inf
                      1⤵
                      • Opens file in notepad (likely ransom note)
                      PID:4748
                    • C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                      1⤵
                        PID:4780
                      • C:\Windows\system32\NOTEPAD.EXE
                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\l1uau-readme.txt
                        1⤵
                          PID:4088

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Persistence

                        Change Default File Association

                        1
                        T1042

                        Defense Evasion

                        Modify Registry

                        4
                        T1112

                        File Deletion

                        2
                        T1107

                        Install Root Certificate

                        1
                        T1130

                        Credential Access

                        Credentials in Files

                        1
                        T1081

                        Discovery

                        Query Registry

                        2
                        T1012

                        Peripheral Device Discovery

                        1
                        T1120

                        System Information Discovery

                        3
                        T1082

                        Collection

                        Data from Local System

                        1
                        T1005

                        Impact

                        Inhibit System Recovery

                        2
                        T1490

                        Defacement

                        1
                        T1491

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
                          Filesize

                          328KB

                          MD5

                          2ad11300ea49275e59564dcc2bd96bc0

                          SHA1

                          6a129bfce9c603338b41f11fd6deed77dbf3e0c5

                          SHA256

                          ecb451deff3384dd3ee5926f56eabc73e1d870831af471efbb03569d0943532a

                          SHA512

                          a6f7532d62578d408899b54fef7414c457ad2b06af26adfb7aa951c887cae4c878de71effcae37efb24830c82a67fb78c7a736a73bca94a72d302e1e22c4d011

                        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
                          Filesize

                          86KB

                          MD5

                          f64e665d716ea45b0703ea1de11ef297

                          SHA1

                          d16ddbc5431df5ba6ed1b002dd53d8147ae5b92b

                          SHA256

                          a0edc7f462ca07b88a73150f7e11eda80783265446775759fc5b195407bdb6d6

                          SHA512

                          b57cb33a9ff9651477b70f1fc03cf713210398625d10e289d3d4513a73d11098217e476824d7f2831c7ee06153798a2cd1550439ba71468e7059175533114f65

                        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
                          Filesize

                          5.7MB

                          MD5

                          992d6f805a56370b158a185b5abe0edc

                          SHA1

                          99591536581adb6e818df90f264f2cda88b7ba78

                          SHA256

                          6b907690201992327a45f2febea403a3d8e501dc830e2b3ebf64394941e976c1

                          SHA512

                          62485bb5ab474acf7d60c3286775175f0e3d2333014f16e9d9dde50b75872368d0e73e783fea97061ff50785cb037a807ac886fb3a1d902490f906beeef28938

                        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
                          Filesize

                          175KB

                          MD5

                          df7bd3cc011f8371c346bb59d7143bcb

                          SHA1

                          077a9aae9c2a2df960310ac6373b1705cfaaecb2

                          SHA256

                          a77c0b5b1a0bfb43bf8e80fac5bc3ed45696b74258b45c78999e4bcfba6e0624

                          SHA512

                          b02999eb265482388fd347ad8b5b61605d6eec7b3dc73c2b6d8615a950f134d878d0629215645faeef8d7931616c24475bc9bc4189832e2c497b9f291384e079

                        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
                          Filesize

                          9.4MB

                          MD5

                          47f8852fb26d86c9ebb4f38a0bd1cf97

                          SHA1

                          5e24535b7b8a897886d589a8a09fb0a629bfe410

                          SHA256

                          65e8f0a543b2f8309b14c1aeff6eeac805897efac688d5ef62cdba5f5c96f989

                          SHA512

                          5b85efd2b01bd7836a98072968011fedbf119a491355657c5cccf127b7a544ae6e75762d297cf7b7f18641677cca88a7b3ae302d55e4fc2b910b905291a8ed21

                        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
                          Filesize

                          2.4MB

                          MD5

                          c0200aa7c15d04df7f872cd2e9a81b23

                          SHA1

                          5759ab3b14eb58fdab0dcad355ec9abd5ab9d9aa

                          SHA256

                          422830b5e359afdf275a8567a29a94fc59727c086c174d7d06b4be97d626743e

                          SHA512

                          1b88cf6ccde5f4d00a059fff0aa77a494d988c938796769f8a04ab2e7b5e765958ffd1330c7144d978e5eb219b2908f97455a76ba50fec494ace8fe33f3e22dc

                        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
                          Filesize

                          183KB

                          MD5

                          f74309765b884a64fda513e318edb0ed

                          SHA1

                          283691d0f0ef45e0372c209e549233938982f9a1

                          SHA256

                          08d12ffb1d0dd8c404a54b260006dd5159802be200a4a588c5d144d3e772926e

                          SHA512

                          d6a31344db1a7e1c5d85935ad783a9e4d299871195555da69b68be1fc296d5dba8387713e1109f32e010d95fcaf6a01acac53773120056c73c8ab2f884c3c2f1

                        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
                          Filesize

                          131KB

                          MD5

                          f7a92d34580511b043234a5b84f11444

                          SHA1

                          194b8918fd020ab9d78fb691d52a63be56dd9fd3

                          SHA256

                          66884326706f740dc52f57f60dd449e6fa6070389a81fba1522204b26476156c

                          SHA512

                          295301fd8fad5872a3da5e24e339da7a5b806fed72087e3f4a94705d9bb02cd431b30b53403731774ccd10ec5bb913bbb748985aca76ed76a8d32cee8f312c3f

                        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
                          Filesize

                          254KB

                          MD5

                          557816f7189f0526f9d77b1c51376185

                          SHA1

                          aa67e15ea9e6953f3ea506e7abeb478b783c1ca3

                          SHA256

                          4d87a6d29ed4e18731ec60112afc5c79a9e5a60030bf5701e4c94527a9914be2

                          SHA512

                          a88694eb945a7d7d6f9adf30d8916e590398e57f71e2f1f93456fb39a68ca82496f888be2a69151ff901d00a9e7330b7bd28ee36efaf2a42d9921a88f8ffe9a3

                        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
                          Filesize

                          386KB

                          MD5

                          2ff0923404cabe3fb3c443e119b93b8b

                          SHA1

                          e0821bcb7c3edf06731c2d721360c0e7670b3f78

                          SHA256

                          61427a066160e7309339dc99bf890e61118415e2df61e6058250c2b11ecb1959

                          SHA512

                          6525ce992e3df89bdc1e937699835567456e8c265a95110de7a4676601fc7d30e7a384734b51328c68199281c1cc51e7ddc7ddc4cc6662a7d02298c16b71803b

                        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
                          Filesize

                          92KB

                          MD5

                          1f3b73c683362ae586e824fa8689fb7e

                          SHA1

                          c89c488ebf3e3ec4b8bfcb175a306b7f131f3a87

                          SHA256

                          2cc0a2cae92c77f6f568eae551e4c7776317199c242cd3147df6066677462a77

                          SHA512

                          ee79e3292d91059c0bfd5e86752f665dcf3ae34686e0dff04d9aaf554e3fbae62402ffa82cc962c8b5ed09aba7c6e63d47545f7984473eedcd531fdbf24ee151

                        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
                          Filesize

                          147KB

                          MD5

                          771018b3cd6dc22024f2cb08cd0808cb

                          SHA1

                          d30dd47a2591868eb4ee1c84fdb6c7086e337a46

                          SHA256

                          8dd5b825405bb8a0efd872d9af749678f8729beaaefae3d2ae80c9f4716d2fc8

                          SHA512

                          efaafc3b12ccf94a2d651d90b5983786fb5336768cf8f798bfee33e82e143bcdf28587c2de9c8c0bad805fb03dab3853c7affbb5ea3fe3ac9171c6963942316e

                        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
                          Filesize

                          125KB

                          MD5

                          8edbf1fb4acace8d61d730229f54916f

                          SHA1

                          7d471f68f54096ba9f24310b3d3baa89bb8c1ff8

                          SHA256

                          498e0412d3a4506201d377b36739e5221d4c78618c39ba03ce61d581266b6514

                          SHA512

                          c77832e148f6f632cc3f45f2ffe1b22e1441e61e099a3ee592122684a81d6ccc738ed77d9121ec85e907f11318dd22d8fb27aedf3d1eeaceb370808a550c6623

                        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
                          Filesize

                          142KB

                          MD5

                          009714630705298003534ea810df32bf

                          SHA1

                          4e91c9e68d89e4175517b54e5026f800e2fa44bb

                          SHA256

                          f8740f3106634f193b90e94b971cae1d179a7f43c551e19511634120f5ee5bd1

                          SHA512

                          d61a00fae6c9172ee4352e9dd0f112ed840e6e5b739b358a2b8eee32d61125b0dd7343f21c42d853ee86deae52efa11a9b5af200eea015846f04a44ebdca7986

                        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
                          Filesize

                          278KB

                          MD5

                          e90d354eeefc082ca3cb4a49ee44fff1

                          SHA1

                          2390b65008fc549f934649fc706c49e28fd298ee

                          SHA256

                          ed4b35011a1d1676cd960ef9d77e7be3ae5fa4fd3af1c3ef2a3ba128b8e28696

                          SHA512

                          c8c67def52ef15446df09877a344c8770e0a3241e8d13cbb976c812ddd6f6d718470788311c4948b51dc1e0433abc9e034dcd1729ff9fa8880404bdba50404b0

                        • C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
                          Filesize

                          454KB

                          MD5

                          a2de7d548b3ad05f6f9ba5b663c9bda6

                          SHA1

                          680b23eca7a7df91cdc937d727502e883374bc94

                          SHA256

                          48d35c563c30d8bb2a3b2057db2c15b84c27d70733e2029abfa8b7984e44dc14

                          SHA512

                          499daae90d8623ae92af8c74b85fd25cbbb65962bbc50aaeead32f4e1fb53a8cc47964be0676a9e1d88b65f86d9f973d0ba47b26eabbcdd65ad71bdcefca2887

                        • C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
                          Filesize

                          1.2MB

                          MD5

                          ab66b64277da741b047df1c96b4eb98d

                          SHA1

                          281479d360c176aca1fba301d297eb6efc30c529

                          SHA256

                          ed0bd19e845c6e254f51210517feef3f5999d2c2144e2b147e5fd852ca66f2be

                          SHA512

                          50f07dbe8696142e680defa510b608d36110272fa21b6ce6abae646187f6dc40d4316be935674680f89b2174c25fc34ddb1d6f33cdbeb8687c680ffc8748b161

                        • C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
                          Filesize

                          466KB

                          MD5

                          d57954d76d63b69d1ff82f6e62cee30c

                          SHA1

                          e58d3135fee95ab2a451a2c40aa725ef1a97dd07

                          SHA256

                          e4623665eb98736bd9b311fd6400c52382b4b01eed16cc1f4bb213b5c428a9f2

                          SHA512

                          0d35b2a20c12e03c4ad4f8d046eed632a4343ea9388c17f69a8934afd8a6901be3846bcdeac6c23dff8d6de474972055fd073ad222a51ceb13f6e0d83a61d7b7

                        • C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe
                          Filesize

                          942KB

                          MD5

                          fde278d8122d65d91bec21fdd7a14dd4

                          SHA1

                          f4fa8a22327c290543e871d0ec1f93ee9ec97721

                          SHA256

                          9d26a6e2760bb199e4ec1b03061567598d96ae8bf6a442d6de6cbab39d4facbe

                          SHA512

                          61fd330f1a1324cb25655c78a62edb5c866cf6161f09b0428467e2b5d15c3ff20f3fb2bbdf8c3de93e9c081473742b073c0fb09d34dec17166942bd3b7f417ca

                        • C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe
                          Filesize

                          623KB

                          MD5

                          de228ae7d0abac4614a534c486263730

                          SHA1

                          3450dd6bfb7eb500b22369536b7c634a662be0dd

                          SHA256

                          aec6dd055e79907ee30659f0edbb0ba73870c8ac5557d1c0725994c081146689

                          SHA512

                          9026d6bf66bd1f3fdfa3de7c72bb050e181fb073602adf01342d78ea82dee755217b8a02c59ab121ea8844629a01d9bfda9579f484e199538635fef029a91ebf

                        • C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
                          Filesize

                          121KB

                          MD5

                          e5d7279cc49074499607c8ac2bc39545

                          SHA1

                          1849dfe7daa4f7fbf756cfb79220bbf7f7fa003c

                          SHA256

                          525c1dc757d28e4399a1d59161741cc4542f3c6c62a9d73bd9406d5078e0491f

                          SHA512

                          419e1a5363818ba58e4525c0b30f5089dc1caddfdf9d1688e3cb2ac86db852565fb8f5c121b3f7e7c4c2c7e4306ae49a99dbb424b247fcc44cfbf6047008984b

                        • C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE
                          Filesize

                          138KB

                          MD5

                          abf3503731e8b1dcb8ebf5ebb42b0088

                          SHA1

                          5bac13ec2fc20fc01c1be716e56b90ce99f92629

                          SHA256

                          c0883c6d9acf15b8a856b5258f805d88c92642a46c44dcbd81aead5661c8fbc8

                          SHA512

                          2312a8a51da7e8f1ce4e193574123d934eeb8c9a08371b5d1073cb17aff08d1284584608c1f86a65562cc114589ce9918027394ea06392f1764f2e6e9c1e60a3

                        • C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE
                          Filesize

                          217KB

                          MD5

                          127fd5947dcc055f56f4ef6e1a6151a5

                          SHA1

                          be7558609041b78c1c8e336b79f663fe70791d44

                          SHA256

                          5e468daf840d9297575bcc478213cd77943daf9650c6092f91f5160543f95db3

                          SHA512

                          a608acffdfd266bf1ae349d91f297cf1012f3e305f62751646cd0e8e6cee868764c033c4b6fe4c4068c4f4e5287218d5d64c8ffb6dcb31c7f95c90801ee09bad

                        • C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE
                          Filesize

                          138KB

                          MD5

                          81bb0569f64eca4e40b809bf7899457a

                          SHA1

                          95744ac57ab51102cd7c290b66a5f5c44109ff2b

                          SHA256

                          0429992fa7d6b3e009bea26d63f1bf819c36a4be8cb32190e3c1e39039130ef5

                          SHA512

                          470230042a8fb4b84350c4b49e2d1066ee7686303030c802cf091379fb392ed71cfab329f61724f62e2669fff88a52ef0f80d11c18a75f986f6d15f871f031a4

                        • C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE
                          Filesize

                          191KB

                          MD5

                          d48cc565d512ea0e558c0d21a4849a56

                          SHA1

                          4de519c0a0999f54d99cba9c068c36551f13eb83

                          SHA256

                          07342f809065bf6728cdfd3b74be886d89152b4d33cc3b3f11c171d4523be6c8

                          SHA512

                          5da0271d6e8414a5f14c560f5cc4b47c63e944d1740f9bdc0c79f5721b60ba22c3b151f61e429d9383468c4b7c23140bf7af77f591b42e4868a4cb2a807fb3e2

                        • C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE
                          Filesize

                          251KB

                          MD5

                          1fd29f8c494f2d87efd392bb3c35252e

                          SHA1

                          2a44e3e9a2a123851c9b29d76952b47efbc0c112

                          SHA256

                          c49ce4c31f4417fe9a6d75b4e8efa468d428191712ece7076a539709b2adda85

                          SHA512

                          0eabd05991bafb02f4e26bd7f0010fb8dc7bee62c550405f8206dda430420a5d5fb7a59788a64e8efad5e50e3f7694d965dacf8412e954c757177d6a71f1354d

                        • C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE
                          Filesize

                          326KB

                          MD5

                          f98e3b8f66eb9512a7e0977984e5e7f8

                          SHA1

                          a22ad133ed500134d02ed6bf24dcf18b6bdc1e15

                          SHA256

                          567a28fb93c1fff70a76e0976aa60b4885cc2cbd6e23a53cc467cc60e63ffae0

                          SHA512

                          19f97e20d3b0421661e31c0a2665fd696ce60cf21a1b050d234217722b317bcf14640fa7d329e5a4e1a4b2f113484e900742855f23b8b02da1447bc256555cd5

                        • C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE
                          Filesize

                          404KB

                          MD5

                          b46611fdf506f65f72b6e60c22d0ab74

                          SHA1

                          697ff9452c5e8bb07007071e8d1a7c2cd9296533

                          SHA256

                          a26019853d13156364be913df19d3258323eaae5cab3995e9e613d3ca61beb8b

                          SHA512

                          2572e8fd91b1d3ecd55d3642ef6260119a8f0f45210e1e858fde930a1d242dbb6a0175fe3194cc7a8bf607278e51454ddcb68f8692ddbd83da5549617c7a1884

                        • C:\PROGRA~2\Google\Update\DISABL~1.EXE
                          Filesize

                          191KB

                          MD5

                          d48cc565d512ea0e558c0d21a4849a56

                          SHA1

                          4de519c0a0999f54d99cba9c068c36551f13eb83

                          SHA256

                          07342f809065bf6728cdfd3b74be886d89152b4d33cc3b3f11c171d4523be6c8

                          SHA512

                          5da0271d6e8414a5f14c560f5cc4b47c63e944d1740f9bdc0c79f5721b60ba22c3b151f61e429d9383468c4b7c23140bf7af77f591b42e4868a4cb2a807fb3e2

                        • C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE
                          Filesize

                          279KB

                          MD5

                          ab13f381a8f88f0183fccb48005ec571

                          SHA1

                          e51dde11f01dfc036fafd4333967840334ea62e8

                          SHA256

                          93e5d8b6dbe29484ea0b6abe87fb06bbe96fcfd49cd9ce8b5a1126f878af5868

                          SHA512

                          baf5ca21408bb1c2b8091030cd78891d92dc6f94c9ddf410225135e94b0b390449479e3470ce4da0dd53338ce2f663d748d2480b969bc43a653c4a39e46303f9

                        • C:\PROGRA~2\MOZILL~1\UNINST~1.EXE
                          Filesize

                          129KB

                          MD5

                          b943ccde0451297c4a52d7f52128dc7a

                          SHA1

                          5baa6d32a22432b3d04fa94f78b7d7eda6c72b4a

                          SHA256

                          79801a8ba8ebafe817050ee69e54724188fadfc7ffac782ee167955ec3cb7d6f

                          SHA512

                          56ba6b15ad3b40ca50113b0252283f4c0ee4a7fc58293321c44c1764a0ed3d3f4ab334d53fcbd0e093466c9140189384cbb319956b753b070b971639f1e70b01

                        • C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe
                          Filesize

                          494KB

                          MD5

                          dfae9fe0128a3cf16202da4e07f92f6b

                          SHA1

                          bd23c6ac66a54dabfb87c8480b94f9320aceb96f

                          SHA256

                          54576f363d29339c302317a63d0a513e1805cf4076783deda539b0a9e1c4ccdf

                          SHA512

                          5659c8b3a21202245fc6885b24d07ae3bfa2c19551fa235736eb1702813c156f2a2b92c652c09e25bbe77a7c27b505155dc7e5e9a52dad8cba2a53aa9cf378e9

                        • C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
                          Filesize

                          6.7MB

                          MD5

                          6e78e577ad35a3bb4356bac7cf2854a6

                          SHA1

                          9f8717a2d899a27e3da947bfc6aedeeec0d68d68

                          SHA256

                          e4dc3a14a2332ce3dfd1dd03ba4aa01fe19c19c2847c9e2f3351649c880c6925

                          SHA512

                          7129ccb7acef36aae40dae6d8af25f7459de87355b9951bf39c84ebd5b4086985f4c97fb0c7cea4661df46fddf84f15c303dc0bcd2cca81cff53d460453e14da

                        • C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE
                          Filesize

                          485KB

                          MD5

                          1667041e2660fd5337833e038692714a

                          SHA1

                          f9876800bac72a8f0246245b74fbdc2893028b7a

                          SHA256

                          55387def53b316cc240e1b8adeef45a5ffb509ac88c62e3c06c02b710fae4762

                          SHA512

                          3dce201ebb1408eff937f514e0503d5be033cbb0c67e042fa136d2a2cb7db8d4aa0de8b61b1d7e312a60d94c7a7e0ca55b41569ef4b319b3c045c44c1b1e4b55

                        • C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE
                          Filesize

                          674KB

                          MD5

                          d05f5c25b66d6321ea7ee1b02cf5e231

                          SHA1

                          9c09485373d0becdbce7c430cf84152edb0aab09

                          SHA256

                          0e7958fcff9e0cacb5629a0aba2278a1afcdb8bcbc1b2ccf32d5621e2e97b854

                          SHA512

                          5b29c543d3a237b56e3238cfc428dfc3a94b85499d90648da57bf142201a03977e0e031d9f248555589f78825a98dc78e842cc1b38917666f39e66b18fcf05d1

                        • C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE
                          Filesize

                          674KB

                          MD5

                          b382592ef61da60cc4f2bb94becf2077

                          SHA1

                          02ebb03981919cd23dffc378e15bcb858ec73104

                          SHA256

                          891752e283b2a4490e09f0c0a07f7100b768dc43eed031990d991d4201449c2b

                          SHA512

                          d7f9f6e06c5dad8887067a929e23aac30e98dec42d176f1f8a309a1304eded98fab904e0fbc12fa7abb22a40217939923132269c348ab4131628323f50b92d5b

                        • C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE
                          Filesize

                          495KB

                          MD5

                          71f6943b845b0f16f2055a40eae6854e

                          SHA1

                          437cdddc054e9f11c9dfb5fe45aca5be4b993987

                          SHA256

                          5a9db6933b75160388d1258e8a8e0cc687c3a846fbed3ecf7715766549fc82a1

                          SHA512

                          d505e7b0605c3169ce71a715928fc4cb79ac266bbb3b09143462cbce0f58bac6deaf1fed64418651ab14bda3da902e2563cf8bb2a20e66c3749b0329ebbed96f

                        • C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE
                          Filesize

                          485KB

                          MD5

                          7ebd44fba8871a5e14092fb1f9d05bb1

                          SHA1

                          c4e1639e431f9c9058c898e574b24ad33ba290b7

                          SHA256

                          db27e54f4835715dd4aed1fc482d2d9d564b814da743d1435a95cd0d19f8b941

                          SHA512

                          3d50f3005b88561c2254c51938e95546ed4e4a9221ead757cb0a8067b60352dc74d395d35bfed7a3965b3c901b6633e8e6140fd0dffa5b2014a96476db8fc8ee

                        • C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
                          Filesize

                          495KB

                          MD5

                          34cf248013321558d95a58a1d33a00d3

                          SHA1

                          0e94fa1391ad33b1dc3e1a81f83476c0e3b8e41f

                          SHA256

                          28e85cf418321b5f7898a4c386283ab8d02cf56e6f1ee9d1af192e2222d9f32e

                          SHA512

                          cf2ae5fab74473be8b5899016415d5599248062a0c4733c0592bf18da5c044d8498dbaa71725f23b544e3d9e5daa396c242e99cd415028ef1f0f86e3c34bd881

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                          Filesize

                          4KB

                          MD5

                          f7dcb24540769805e5bb30d193944dce

                          SHA1

                          e26c583c562293356794937d9e2e6155d15449ee

                          SHA256

                          6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

                          SHA512

                          cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                          Filesize

                          4KB

                          MD5

                          f7dcb24540769805e5bb30d193944dce

                          SHA1

                          e26c583c562293356794937d9e2e6155d15449ee

                          SHA256

                          6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

                          SHA512

                          cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                          Filesize

                          471B

                          MD5

                          f60b261fa864803670980251960b8d45

                          SHA1

                          0423aa6407d944a6f826e8ff197014a75114572b

                          SHA256

                          e55b79fb46ab833b600da6bcc39eedf6650e6dc890485c85e41e14d11ccd0055

                          SHA512

                          2e8ba8c5e37d8fa0d26237bac4c47928a28762959bb2873269721c7d9be7b66b10e6d058d9c855486948ee8eb591e5fd3a57fb091e44e4ad16436af74b4da357

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                          Filesize

                          340B

                          MD5

                          cee55e0c6d1f84b39afdc8f10226abb9

                          SHA1

                          a9f6f5de48e0ad0a6718a77b70c19352e89bcaf4

                          SHA256

                          8343c4cda5a2c892461b046c2eee95afe6ed2e824bbf4a92a2eb5f8c30c60a98

                          SHA512

                          87e9af19dddd2f84a3f79cf57570c3e7b1242053acc055365ad2f65e6f6375162854ed0c9068eb61d11e581f8f3e4a8436c3417a979e3f94b3c84c967913d1ab

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                          Filesize

                          340B

                          MD5

                          67a59bfe296065ced1620f62b6c1c73a

                          SHA1

                          939f3a241cafb1e310e8cf91b6fc8cc2e197dbd6

                          SHA256

                          cd250d08ae8f282617a6f24a330e3b9abd5be82f208fb4f25b60044a6d353877

                          SHA512

                          e3914b43d39ea38736a5f759adb05c47b505ffacf9b482199f3e53a45a87bd3f2a1e93788ab9a17a156daedc4d72ce47f00ee352290d33ad374a56aa598adb84

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                          Filesize

                          434B

                          MD5

                          52f3576af30da0546971eae0114c79ab

                          SHA1

                          14e8945d09dcb08f568831b298cf243488e9dd20

                          SHA256

                          7174351b8a4fc73ce5f514169c12cff1756799aa96df1aeac0184c365655864b

                          SHA512

                          1765208b744030a49d19d669cbc4e98853333f61d5302db682bac8a386dd14a6709d777fd1edaaca6bdbef00a9800274826877d488e549b6a2a213508503bc04

                        • C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILECO~1.EXE
                          Filesize

                          499KB

                          MD5

                          905d453a862088233ccf791fd82f3b89

                          SHA1

                          e6b062b6121bd72d94dd262af13be45441982922

                          SHA256

                          f8e418429e0aeb63a6466c69e6997e44ceaff3f7ff6edb0d5c0af43b06695dea

                          SHA512

                          e00088da9157342f8423ea228bc68564392c6cf897771136d3f4ca364a5e1200369a3d9608f01872892074c1dd0a232cee0a17b2befb6cfd445687f5960f1036

                        • C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\181510~1.001\FILESY~1.EXE
                          Filesize

                          293KB

                          MD5

                          ae524cfc4fc0db45864ed8e94cb45de7

                          SHA1

                          a43bdbbbd9fefb10a1ec83637b63385d834abcdd

                          SHA256

                          7d26826c47dc9bbbcd63454436f8a7769268c925e2d6d7c35a80286abc2d9599

                          SHA512

                          8bf1121dbe3265563a34990d74c60917cc674361e8b1d9f81491791a22c8c4a487667fd852f3b99eb3ccbd4fdf8651aa3c91d30c94f0b738764193c7664f3c69

                        • C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\ONEDRI~1.EXE
                          Filesize

                          2.4MB

                          MD5

                          c6689b36f39d3813c630ec0ffb3be5ed

                          SHA1

                          4b70dc7cde84549c5e66ac502a6e4bbdb6789281

                          SHA256

                          509f6ae9198e25814b9097b19d7f8271baae43e25f420198980b1b4ad5e7c0f9

                          SHA512

                          44ed7f00494f4d2fa8d0bb5f08943c848a3c6c690371eab9149ea1496106af5123079549a3fd186797d966fb3bf2b9702cbf6f16f2c1187aff2e73a31efeed95

                        • C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\OneDrive.exe
                          Filesize

                          1.6MB

                          MD5

                          cf06a58cfebba708b76cda654cf000dd

                          SHA1

                          43e422afda7f75e9855e641c1dd9137496730f88

                          SHA256

                          f1d846a6e9f0c1ef619a04c9fca1c6fea8a9fd2a022045a1fb9104e5becc8703

                          SHA512

                          262605d2b5fa6fbc768013ce3c5b60735bfbfebb6243fc4e3f98c6644dd6e222fe425ba77a9affc4c259dba1987830ec903a0b3b27d0802123c5dd7de999ec9a

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\T7JFOISB.cookie
                          Filesize

                          615B

                          MD5

                          38dd984f766f4903540a94d2a836922e

                          SHA1

                          cdc83f91cf1f9608032e50e7152017096ae3d777

                          SHA256

                          c22f3b5e88d6ab912031dfab3036b3787e63858cb194b580f5d99ec95e114580

                          SHA512

                          1fe632b5c5a38427200aa477fa2144ea925e1d6b55c05fc58680ba2dbf3ae1e77232f56cff9a3a5020d023580c3a12862e3a3d737329602e69b1250a268e4e53

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\ZJIX01N8.cookie
                          Filesize

                          615B

                          MD5

                          f7a88a10874c2d5cba9c6c72e740a92b

                          SHA1

                          22cdc86e22145b80efb2971dc4d50039daa60491

                          SHA256

                          8b04c28f2800f905f13a5f8d3878de38eddc56611b6f6f2a8cc916df87234465

                          SHA512

                          66b84358896a9882371529091e41f0ca9d85228a2cd69a767a1532191ddbcd05a8782b0f4d113018b44985ec9cc61a0b4578f216bb304c273ab95c2a49ce8c16

                        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
                          Filesize

                          512KB

                          MD5

                          232308f40ec2b42c2ed38e66da4c07f2

                          SHA1

                          791f66aa3b0ac1d4efaf616da912a9bcca794a98

                          SHA256

                          658da9be2d22816010696bb1f9f75b83e829de46d258f46812c570b9c0bd820a

                          SHA512

                          12786c90dddf1fd29c8b6240fe6c2735b2f714771602b68190ee33060ce045ca8819ae17236d76c9eb0950cffa4ff8b77b1c084e77e62b7b842b837d4e83b127

                        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\edb.chk
                          Filesize

                          8KB

                          MD5

                          42456f8e28b5f63466262853609a9e9f

                          SHA1

                          9f637a30ee0e9b4d6b4395fcaff4fbd9f7bcc0c9

                          SHA256

                          f1a4346234a5ca356aeb870ddab871a71b07190501403377bdb114efa0f37ed1

                          SHA512

                          e6956238b4427a3d1d20bcfd9633a086b1aa98908a5f8bd9cc4271229339a23b4e639e46f217d408b8d43fdfed6c674cd80f410bd36841fa2ad655bdc17efe89

                        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb
                          Filesize

                          2.0MB

                          MD5

                          247c6b8c9b09e4f2422d749592c4f133

                          SHA1

                          5e94390a8a150e1655810f1f8da666098c3d73aa

                          SHA256

                          42514f4546c4cf3c52400b9402f55e12efa21a3627bccec4ba5d7adfb143ffe3

                          SHA512

                          5417c5d9b5ffdf57b1e76c161cdcfd4592884e581c615fa148f03e22e7d4b966f75a734f6939cee1f625396d324918bdf60ae87ed8e2855bc2ae890fcf9e6ea4

                        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.jfm
                          Filesize

                          16KB

                          MD5

                          025d5a53fc7a2bae2729d7674e5550d0

                          SHA1

                          f4e19c0bf006ec6df33791515875ef0acd8ce777

                          SHA256

                          160529ba226c76e8876f577d11344fb71ae11af512d1b25b17169cce9aea1597

                          SHA512

                          e40f9b52378a757001901671d2f21704b9fea10628a2bd5a80a679d90b4bb2a17e12b11431718f92853940038ba29610f19d7ade9d0daabe6a2bf69b20b3a06d

                        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\RecoveryStore.{67F4A512-A504-4858-837E-5F05588D210D}.dat
                          Filesize

                          4KB

                          MD5

                          f447a90ca6d8ea37d80a37c6c7ea194e

                          SHA1

                          594ccdf282743e5c815f14ac742cbeef1448fe7d

                          SHA256

                          c9a4137c5e182703d45c2d624a1eaa9a035d60d1867519b1cd0bdb2a524b4182

                          SHA512

                          7c1895d450db525cfb53568bad0792302fbec6bdbabeafe43677f2ace31cba6e04b3ac5e55cc1523018bf4a504400d994f27dbd16e6af73ab9d098a4f54a50f2

                        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2219095117.pri
                          Filesize

                          207KB

                          MD5

                          e2b88765ee31470114e866d939a8f2c6

                          SHA1

                          e0a53b8511186ff308a0507b6304fb16cabd4e1f

                          SHA256

                          523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

                          SHA512

                          462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2023-02-08_69d6f75b8cfd52216a6ff4b0861655ef_neshta_revil_sodinokibi.exe
                          Filesize

                          179KB

                          MD5

                          d0190f94e6d05104977c53b55dbc2911

                          SHA1

                          c0ff002b0e26b180a741c3cefff15190df7746cc

                          SHA256

                          f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69

                          SHA512

                          d4b1cc032f9d8254ac6035c27948147d8c4c5f60be51e632ba26c6e34ada87515b3113b4bd1cec3cedfa1a73c465a1267681ca05356d8f2f08d81c4fef04d868

                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2023-02-08_69d6f75b8cfd52216a6ff4b0861655ef_neshta_revil_sodinokibi.exe
                          Filesize

                          179KB

                          MD5

                          d0190f94e6d05104977c53b55dbc2911

                          SHA1

                          c0ff002b0e26b180a741c3cefff15190df7746cc

                          SHA256

                          f4e5d7a95681d920dda75fe5dd89be249905e2a7712f9b3b39e19351f5ef5e69

                          SHA512

                          d4b1cc032f9d8254ac6035c27948147d8c4c5f60be51e632ba26c6e34ada87515b3113b4bd1cec3cedfa1a73c465a1267681ca05356d8f2f08d81c4fef04d868

                        • C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
                          Filesize

                          8B

                          MD5

                          7f025521b2d69fa10b63d5815c778088

                          SHA1

                          4ee9938fdd3d65ab0f1fc44bc6c4d9e69c74088d

                          SHA256

                          aad030ec7a62e88697fb17fc300898b8f0d18b96261c3225efda37b0396f5735

                          SHA512

                          9f66c9ef69ac83866a1cb836ddc34a6ee6fe9836f3bb513cdd31653c77eb60f46972c8c70b6d6a3f598d9552d53ea294c6ed6cf8461b23d7608c83be8b0767c1

                        • C:\Windows\svchost.com
                          Filesize

                          40KB

                          MD5

                          f8bb657a6fc0c20225ad5e94276a656a

                          SHA1

                          a54b415198a6c64ebd84895fc78c544efb3377a8

                          SHA256

                          b878817c18c7103c4c9b8649cad38b16341232386a29551453193c46703bcb2f

                          SHA512

                          a7e2a3a0be0d908b03ac47e9a756e0cdd71a5a80486d48907d52ebd276e5ea983f2825390ed37e7c332ed395ac5104a6cd48ff464c2cc3e6338471ea08d78a66

                        • C:\Windows\svchost.com
                          Filesize

                          40KB

                          MD5

                          f8bb657a6fc0c20225ad5e94276a656a

                          SHA1

                          a54b415198a6c64ebd84895fc78c544efb3377a8

                          SHA256

                          b878817c18c7103c4c9b8649cad38b16341232386a29551453193c46703bcb2f

                          SHA512

                          a7e2a3a0be0d908b03ac47e9a756e0cdd71a5a80486d48907d52ebd276e5ea983f2825390ed37e7c332ed395ac5104a6cd48ff464c2cc3e6338471ea08d78a66

                        • C:\odt\OFFICE~1.EXE
                          Filesize

                          5.1MB

                          MD5

                          35f43ffd6f3e21e90ed23f820c1de339

                          SHA1

                          5510a6a44ac45650a61a2b669c6d00aa83325e44

                          SHA256

                          718d2e212e6cb08f46e29f32069868c7385321afca989ab1fd06268c287aad7a

                          SHA512

                          388f6afd13d6050954fa444b653834a3aad14c3b046e8eb1d9fa5ae9a92b98d76ac6fca1c9232369c369b38d08c2916eeda01278437ee841bce6a75b79797f3b

                        • memory/2792-153-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-136-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-121-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-122-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-123-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-124-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-125-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-126-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-127-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-128-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-129-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-130-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-131-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-132-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-133-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-134-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-135-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-137-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-138-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-139-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-140-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-141-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-142-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-143-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-144-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-145-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-147-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-161-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-160-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-159-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-158-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-157-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-156-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-155-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-154-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-120-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-152-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-151-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-148-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-150-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-149-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2792-146-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-175-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-185-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-162-0x0000000000000000-mapping.dmp
                        • memory/3636-167-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-166-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-168-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-169-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-170-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-172-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-173-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-184-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-174-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-165-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-164-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-176-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-179-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-186-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-178-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-180-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-182-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-181-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-177-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3636-183-0x0000000077BF0000-0x0000000077D7E000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4360-261-0x0000000000000000-mapping.dmp
                        • memory/4556-389-0x0000000000000000-mapping.dmp
                        • memory/4676-268-0x0000000000000000-mapping.dmp
                        • memory/4844-226-0x0000000000000000-mapping.dmp