Overview

overview

10

Static

static

3

latestroc.exe

windows7-x64

10

latestroc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-01-2024 19:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    latestroc.exe

  • Size

    7.5MB

  • MD5

    0fb0767520be820c0c3f415fb1bad41d

  • SHA1

    e7d6c9a34762e47075bd7716a31db83b9043ecf1

  • SHA256

    92e4602f85cc9714e48613d178b5dc8ec55bd78474c73c69de3678e94f7f0921

  • SHA512

    482c4a3c308ab5943bb3df5449b3d3ff621cefa45d5ff67022f1b6398b9ff2918c6f170f653c6ebdc2aee9283bc050ce56156d7a439cba9756759e4c4e859a69

  • SSDEEP

    196608:1c7qW725oFNKI4eVrTdNqNkNxdL0ws3vnDcekNeMt:1OqW72oFNv4iHdNkkdYwqDcekN

Score
10/10
djvufabookiegluptebalummasmokeloaderxmrigxwormpub1backdoordiscoverydropperevasionloaderminerpersistenceransomwareratrootkitspywarestealertrojanupx

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

fabookie

C2

http://app.alie3ksgaa.com/check/safe

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .cdcc

  • offline_id

    LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw

rsa_pubkey.plain

Extracted

Family

xworm

C2

163.5.215.245:9049

Mutex

r3SLo8kx59hai6gX

aes.plain

Extracted

Family

lumma

C2

https://braidfadefriendklypk.site/api

Signatures

  • Detect Fabookie payload 1 IoCs
  • Detect Xworm Payload 1 IoCs
  • Detected Djvu ransomware 7 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 10 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 7 IoCs
    miner
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Stops running service(s) 3 TTPs
    evasion
  • .NET Reactor proctector 8 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 11 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 15 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\latestroc.exe
    "C:\Users\Admin\AppData\Local\Temp\latestroc.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
      "C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4648
    • C:\Users\Admin\AppData\Local\Temp\7b0d48dbbf50fe239f1097f5d01c2a6d.exe
      "C:\Users\Admin\AppData\Local\Temp\7b0d48dbbf50fe239f1097f5d01c2a6d.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1676
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4560
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 2660
          4⤵
          • Program crash
          PID:4460
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 984
        3⤵
        • Program crash
        PID:532
      • C:\Users\Admin\AppData\Local\Temp\7b0d48dbbf50fe239f1097f5d01c2a6d.exe
        "C:\Users\Admin\AppData\Local\Temp\7b0d48dbbf50fe239f1097f5d01c2a6d.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks for VirtualBox DLLs, possible anti-VM trick
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4732
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2140
        • C:\Windows\system32\cmd.exe
          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1592
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
            5⤵
            • Modifies Windows Firewall
            PID:2380
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
            PID:4576
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:5108
          • C:\Windows\rss\csrss.exe
            C:\Windows\rss\csrss.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Manipulates WinMonFS driver.
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4396
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:4384
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:4304
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /delete /tn ScheduledUpdate /f
              5⤵
                PID:4468
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                5⤵
                • Creates scheduled task(s)
                PID:2776
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:2188
              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                5⤵
                • Executes dropped EXE
                PID:1660
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                5⤵
                • Creates scheduled task(s)
                PID:5012
              • C:\Windows\windefender.exe
                "C:\Windows\windefender.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2644
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 836
              4⤵
              • Program crash
              PID:2312
        • C:\Users\Admin\AppData\Local\Temp\rty25.exe
          "C:\Users\Admin\AppData\Local\Temp\rty25.exe"
          2⤵
          • Executes dropped EXE
          PID:2272
        • C:\Users\Admin\AppData\Local\Temp\FirstZ.exe
          "C:\Users\Admin\AppData\Local\Temp\FirstZ.exe"
          2⤵
            PID:2000
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:5052
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe start "WSNKISKT"
              3⤵
              • Launches sc.exe
              PID:1672
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop eventlog
              3⤵
              • Launches sc.exe
              PID:4492
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
              3⤵
              • Launches sc.exe
              PID:1512
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe delete "WSNKISKT"
              3⤵
              • Launches sc.exe
              PID:2052
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3996
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4944
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2472
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1240
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4560 -ip 4560
          1⤵
            PID:4100
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1676 -ip 1676
            1⤵
              PID:2368
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4732 -ip 4732
              1⤵
                PID:2096
              • C:\Users\Admin\AppData\Local\Temp\ABE0.exe
                C:\Users\Admin\AppData\Local\Temp\ABE0.exe
                1⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:4628
              • C:\Windows\SysWOW64\sc.exe
                sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                1⤵
                • Launches sc.exe
                • Suspicious use of AdjustPrivilegeToken
                PID:5016
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                1⤵
                  PID:4256
                • C:\Windows\windefender.exe
                  C:\Windows\windefender.exe
                  1⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  PID:2516
                • C:\Users\Admin\AppData\Local\Temp\C0C1.exe
                  C:\Users\Admin\AppData\Local\Temp\C0C1.exe
                  1⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious use of WriteProcessMemory
                  PID:3152
                  • C:\Windows\SysWOW64\icacls.exe
                    icacls "C:\Users\Admin\AppData\Local\48f4c113-fbdc-4a12-bb7f-fcc063fe114c" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                    2⤵
                    • Modifies file permissions
                    PID:1896
                  • C:\Users\Admin\AppData\Local\Temp\C0C1.exe
                    "C:\Users\Admin\AppData\Local\Temp\C0C1.exe" --Admin IsNotAutoStart IsNotTask
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:4072
                    • C:\Users\Admin\AppData\Local\Temp\C0C1.exe
                      "C:\Users\Admin\AppData\Local\Temp\C0C1.exe" --Admin IsNotAutoStart IsNotTask
                      3⤵
                      • Executes dropped EXE
                      PID:4552
                • C:\Users\Admin\AppData\Local\Temp\C0C1.exe
                  C:\Users\Admin\AppData\Local\Temp\C0C1.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:652
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4552 -ip 4552
                  1⤵
                    PID:1312
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 220
                    1⤵
                    • Program crash
                    PID:3524
                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                    1⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1408
                  • C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                    C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                    1⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Suspicious use of SetThreadContext
                    PID:1932
                    • C:\Windows\explorer.exe
                      explorer.exe
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2204
                    • C:\Windows\system32\conhost.exe
                      C:\Windows\system32\conhost.exe
                      2⤵
                        PID:2120
                      • C:\Windows\system32\powercfg.exe
                        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                        2⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2360
                      • C:\Windows\system32\powercfg.exe
                        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                        2⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1608
                      • C:\Windows\system32\powercfg.exe
                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                        2⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4104
                      • C:\Windows\system32\powercfg.exe
                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                        2⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2064
                      • C:\Windows\system32\sc.exe
                        C:\Windows\system32\sc.exe stop dosvc
                        2⤵
                        • Launches sc.exe
                        PID:664
                      • C:\Windows\system32\sc.exe
                        C:\Windows\system32\sc.exe stop bits
                        2⤵
                        • Launches sc.exe
                        PID:2976
                      • C:\Windows\system32\sc.exe
                        C:\Windows\system32\sc.exe stop wuauserv
                        2⤵
                        • Launches sc.exe
                        PID:2600
                      • C:\Windows\system32\sc.exe
                        C:\Windows\system32\sc.exe stop WaaSMedicSvc
                        2⤵
                        • Launches sc.exe
                        PID:2172
                      • C:\Windows\system32\sc.exe
                        C:\Windows\system32\sc.exe stop UsoSvc
                        2⤵
                        • Launches sc.exe
                        PID:3948
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                        2⤵
                          PID:4800
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        1⤵
                        • Drops file in System32 directory
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4576
                      • C:\Users\Admin\AppData\Local\Temp\D7A5.exe
                        C:\Users\Admin\AppData\Local\Temp\D7A5.exe
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:624
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          2⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          PID:2000
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop dosvc
                            3⤵
                            • Launches sc.exe
                            PID:3656
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop bits
                            3⤵
                            • Launches sc.exe
                            PID:4064
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop wuauserv
                            3⤵
                            • Launches sc.exe
                            PID:2764
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop WaaSMedicSvc
                            3⤵
                            • Launches sc.exe
                            PID:4796
                          • C:\Windows\system32\sc.exe
                            C:\Windows\system32\sc.exe stop UsoSvc
                            3⤵
                            • Launches sc.exe
                            PID:4712
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                            3⤵
                              PID:3136
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            2⤵
                              PID:2216
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 1200
                                3⤵
                                • Program crash
                                PID:716
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 1200
                                3⤵
                                • Program crash
                                PID:4200
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2216 -ip 2216
                            1⤵
                              PID:3172
                            • C:\Windows\system32\wusa.exe
                              wusa /uninstall /kb:890830 /quiet /norestart
                              1⤵
                                PID:3744
                              • C:\Users\Admin\AppData\Local\Temp\E1F7.exe
                                C:\Users\Admin\AppData\Local\Temp\E1F7.exe
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1824
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  2⤵
                                  • Loads dropped DLL
                                  • Checks processor information in registry
                                  PID:316
                              • C:\Windows\System32\Conhost.exe
                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4256
                              • C:\Windows\system32\wusa.exe
                                wusa /uninstall /kb:890830 /quiet /norestart
                                1⤵
                                  PID:664
                                • C:\Users\Admin\AppData\Local\Temp\3B33.exe
                                  C:\Users\Admin\AppData\Local\Temp\3B33.exe
                                  1⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  PID:2732
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
                                    2⤵
                                      PID:1984
                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
                                        work.exe -priverdD
                                        3⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        PID:904
                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesa.exe
                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesa.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4656
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2216 -ip 2216
                                    1⤵
                                      PID:4896
                                    • C:\Users\Admin\AppData\Local\Temp\5C97.exe
                                      C:\Users\Admin\AppData\Local\Temp\5C97.exe
                                      1⤵
                                      • Executes dropped EXE
                                      PID:4688
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 344
                                        2⤵
                                        • Program crash
                                        PID:3432
                                    • C:\Users\Admin\AppData\Local\Temp\6199.exe
                                      C:\Users\Admin\AppData\Local\Temp\6199.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4392
                                    • C:\Users\Admin\AppData\Local\Temp\6554.exe
                                      C:\Users\Admin\AppData\Local\Temp\6554.exe
                                      1⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Suspicious behavior: AddClipboardFormatListener
                                      PID:3136
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '6554.exe'
                                        2⤵
                                          PID:1564
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6554.exe'
                                          2⤵
                                            PID:4328
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4688 -ip 4688
                                          1⤵
                                            PID:1948

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Reconnaissance

                                          Resource Development

                                          Initial Access

                                          Execution

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Persistence

                                          Boot or Logon Autostart Execution

                                          1
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Create or Modify System Process

                                          3
                                          T1543

                                          Windows Service

                                          3
                                          T1543.003

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Privilege Escalation

                                          Boot or Logon Autostart Execution

                                          1
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Create or Modify System Process

                                          3
                                          T1543

                                          Windows Service

                                          3
                                          T1543.003

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Defense Evasion

                                          File and Directory Permissions Modification

                                          1
                                          T1222

                                          Impair Defenses

                                          2
                                          T1562

                                          Disable or Modify System Firewall

                                          1
                                          T1562.004

                                          Modify Registry

                                          1
                                          T1112

                                          Credential Access

                                          Unsecured Credentials

                                          3
                                          T1552

                                          Credentials In Files

                                          3
                                          T1552.001

                                          Discovery

                                          Peripheral Device Discovery

                                          1
                                          T1120

                                          Query Registry

                                          5
                                          T1012

                                          System Information Discovery

                                          5
                                          T1082

                                          Lateral Movement

                                          Collection

                                          Data from Local System

                                          3
                                          T1005

                                          Command and Control

                                          Web Service

                                          1
                                          T1102

                                          Exfiltration

                                          Impact

                                          Service Stop

                                          1
                                          T1489

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\ProgramData\mozglue.dll
                                            Filesize

                                            209KB

                                            MD5

                                            d5656a72a1c2e286f6b50a10f2b616c1

                                            SHA1

                                            65a1b757e49a9658e0e64563bd36dc84d129a677

                                            SHA256

                                            4c97a8944aebd40732c5a9816852f96ae08375c7d21503092be9104133686066

                                            SHA512

                                            5d3344b30e3df253d64e0deced9ca7cde669f2609b6586198fdf04d968d7b752daa7e3f3aff4fe14ebfb37b687df95bce8f97728cf64cc2ada7f29b09ca1846d

                                            Download Submit

                                          • C:\ProgramData\mozglue.dll
                                            Filesize

                                            245KB

                                            MD5

                                            1b9e5d2222767e4e8829653e91a98e02

                                            SHA1

                                            721d087f6b7896f48205082e17d9dcb4d361bcb8

                                            SHA256

                                            24442d284475f81ec28ac8fab96f3cfadde7b9c0c83b29ddaa60b0a73201e9a6

                                            SHA512

                                            e3f220121b9f54c43756f7f6338084dd30cd1eae72bbeb5b5dc2e806a17500fa59516a9df78720223142343838c0a083136f7e9e7e9b0da5f2288795e1445b7a

                                            Download Submit

                                          • C:\ProgramData\nss3.dll
                                            Filesize

                                            210KB

                                            MD5

                                            6934f24def1a5d4ccd8213a26b745917

                                            SHA1

                                            47859783dc9052d2d36b2f46b7d2ffa44400457f

                                            SHA256

                                            e1aade33e8b13dfcd842d2a7277dbb9caea0e0eceed890b1b8533ec8183748b4

                                            SHA512

                                            7595fdbdb125c7f4968035ea3d6fb96d3bf57b4bd14cd0600607f235da1664ab897811de2e6c6903b3c09098bf4d7f2cd4fa82c8d842ca76873b4c3db17a92c1

                                            Download Submit

                                          • C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                                            Filesize

                                            120KB

                                            MD5

                                            f5077ca66f6c019e86b222e2a9d5c4d0

                                            SHA1

                                            c6b13d665c84097e73d1fd206f2e0764800407fc

                                            SHA256

                                            ec042951c7d64a3fafb299f39c6e0c848ed74f7033366903153f2071aa01dfae

                                            SHA512

                                            520222a387b869a1542e676ad756da92d488de1496901c62ae55e0300e417c60669284dc2577181ca6fe67d8618d4228a48d11850060f9164637edeee0184418

                                            Download Submit

                                          • C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                                            Filesize

                                            136KB

                                            MD5

                                            0b5003cdb26ce26a91736b28fe6caf31

                                            SHA1

                                            b6710024353610bf2c6f3ff6837057f09cfed8a5

                                            SHA256

                                            729added9c2767a996009acbc623dd7efc71df8faf7a22319fef623951257759

                                            SHA512

                                            747f510a6a980c16f1bbd5bb66a6912bbaa764ed6a923632dd480b7aba81fa08203975e79bf262c1d7a18d94e53eb307a5f3cf6b064d6e47930b8317e7c68f5f

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\48f4c113-fbdc-4a12-bb7f-fcc063fe114c\C0C1.exe
                                            Filesize

                                            17KB

                                            MD5

                                            fee3c12e774fe5f2360c45bb6ef47b0b

                                            SHA1

                                            0b929d2d2cedd40a834f0b5354d59e73069024b1

                                            SHA256

                                            1e453e3329371447bbe877f95877ebbf086fc08dee2d4558544106c308d8ce5f

                                            SHA512

                                            ade2b549e85a13f8999602f304008b07488163a6f15972d38514985fcc4999395a560e0480340be816f0c7d9e37f4c28551c9b44abea85a87d2fae4529a86701

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                            Filesize

                                            2KB

                                            MD5

                                            d85ba6ff808d9e5444a4b369f5bc2730

                                            SHA1

                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                            SHA256

                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                            SHA512

                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            Filesize

                                            944B

                                            MD5

                                            6d42b6da621e8df5674e26b799c8e2aa

                                            SHA1

                                            ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                                            SHA256

                                            5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                                            SHA512

                                            53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                            Filesize

                                            944B

                                            MD5

                                            83685d101174171875b4a603a6c2a35c

                                            SHA1

                                            37be24f7c4525e17fa18dbd004186be3a9209017

                                            SHA256

                                            0c557845aab1da497bbff0e8fbe65cabf4cb2804b97ba8ae8c695a528af70870

                                            SHA512

                                            005a97a8e07b1840abdcef86a7881fd9bdc8acbfdf3eafe1dceb6374060626d81d789e57d87ca4096a39e28d5cca00f8945edff0a747591691ae75873d2b3fb5

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\3B33.exe
                                            Filesize

                                            286KB

                                            MD5

                                            b41a8f418f9fe72c3c7f344624170114

                                            SHA1

                                            fd7d930c9de15cb483ab4713c99bb3f7c2837f92

                                            SHA256

                                            e83cce5202fecd1a486bdfb2aeb46f311c6f66426f3144e1f55e75c80226181a

                                            SHA512

                                            9dcfa1b97f53a5ea6eb519bef76f23ccc95317a52b9ba92e43caa4da60ac62e54b32b3316dd226c2f7a8b0fae10e4c565ca051b9d3fb2c8e5dd9eebff51e845d

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\3B33.exe
                                            Filesize

                                            199KB

                                            MD5

                                            5214f5872c154b832355b70135a0ac00

                                            SHA1

                                            64a9a817ae38b45f59a52f9b28e1838d3dd08b8f

                                            SHA256

                                            351ada0c29106fdea643f92cdef374faafcd359f14cd80a2b3cc088f03401d6c

                                            SHA512

                                            ceb5acb39d521abafd53fa77c0bb57149161c8c131eaa11c5ecb05eb060a7cf370503b83dd30a33fbf43e4832f3b73a8b9cf8d40abd8ef66c563d4274337c2ca

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\5C97.exe
                                            Filesize

                                            81KB

                                            MD5

                                            fd7657f9231d73e503565f3b0ab9c69c

                                            SHA1

                                            0f08267a89da7a50273efd8723aab976a236ec3c

                                            SHA256

                                            2270bd740bed02d08308aa9915446e590aaf665b67701b7ed4ddfb9cadfaf146

                                            SHA512

                                            fb20a0bd16e426914b5088b5feddae76e43125ede961a2a127608f17a2a94a76e20e2105a5a1c80efbc33857d5bc52efdebc0a1704da03ba1807fc06ceea16f8

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\5C97.exe
                                            Filesize

                                            154KB

                                            MD5

                                            4983847690c28e38475ed896e1343bf2

                                            SHA1

                                            f47f36d8894b7f83efb23fe674bd56e2d7c596af

                                            SHA256

                                            e672acd58b8d74f8891c91586fa6102dbc050760a9284668863c857b5c9ce033

                                            SHA512

                                            851e4c10a471a6910e4ac25388e97b3e9213630c86279addf3b873e9954218a376335a8e146336206349397ffa8b164198f39bb342268b3dd83ce88241a8bc03

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\6199.exe
                                            Filesize

                                            135KB

                                            MD5

                                            1141ba1ea472b0c69b0c40ba77ecf156

                                            SHA1

                                            656e6cf78de4435895e56ce51e52bb5e431d3efa

                                            SHA256

                                            c30aec0b7f9603b1fa5dd6a5d1ee29336540e33d5d23a028e901e3ad57e0478c

                                            SHA512

                                            a4bf9cea325e069f4eda615f1ba09c07d9ae1cb165e01933021bab0462087e42fdbd52a70fbe1101907757cf2b5d2bf47bcf96a8461ee7c14c966d796bbf7cb9

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\6199.exe
                                            Filesize

                                            240KB

                                            MD5

                                            d1f8f53b3a2369b70519b08934f5810f

                                            SHA1

                                            2075e6a5dce326fa269d5f518abc63b098abe844

                                            SHA256

                                            cc6887142738a489d6486892347bfe04f90bd89e4144d614f8d74a5daff6aed2

                                            SHA512

                                            daa30d799c57b9f01f2b6ba436a0bed9807f0f0f0b6abb82df9a80275ce131295cbf76200348a0f8a307fbfb19038834fe8cacc1b9ea414c2ad95048d1647354

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\6554.exe
                                            Filesize

                                            65KB

                                            MD5

                                            3b5926b1dca859fa1a51a103ab0fd068

                                            SHA1

                                            9b41d9e1810454b00e12cc386e8e31fc1bd29ef6

                                            SHA256

                                            e1f3e0bc705e2917d285f9a9ab49cc6444ff9267b46cbf1be3b97f9a716e6d08

                                            SHA512

                                            6f924f3b1a7bcce36cea2ef0f73dfcf837b2ec03da44e0a12d6afcd2af1a92d20af251d04fd3970beedad082d646fc84ae7107b4111f43abc12b5a1e3d03a794

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\7b0d48dbbf50fe239f1097f5d01c2a6d.exe
                                            Filesize

                                            295KB

                                            MD5

                                            b4512effb2db71dbe532391edd02907c

                                            SHA1

                                            d76446bbd2244634993f0e0b439afaefb11ce985

                                            SHA256

                                            11a39fc36642ef1e2cdfcef7865a45c4b07812f38c94606e40633f11b061c31a

                                            SHA512

                                            e0ff20f1e12dc5d3bf6e8d4d869a7f6fa348a74765993bd018a4e577f7c3b5dd06686146b9b62c15560546c568469e34eb6e26da7fc4dc894ddd9a144bd7d288

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\7b0d48dbbf50fe239f1097f5d01c2a6d.exe
                                            Filesize

                                            726KB

                                            MD5

                                            4c112ddd7c5c48b26bc9a6ffa95436a1

                                            SHA1

                                            cc9c89a87ced5a9f96713959138252af1b0064ce

                                            SHA256

                                            783c2f792bd905736522f39fad361bb7c90673afde1c46db5b615598e6e6f345

                                            SHA512

                                            08e8a64cd69816dbdfbb01797eb02302178f84e4dab9a805b15e83ccb65ad0cfd41c79f41ec4da4bd1c74f549404d0c462a64bfeb7be6606552ed45dc031028e

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\7b0d48dbbf50fe239f1097f5d01c2a6d.exe
                                            Filesize

                                            656KB

                                            MD5

                                            2e137bd8831af2e11b6f4453fcb5d087

                                            SHA1

                                            027da952554dea20e7aeb59067dcd28b28712d27

                                            SHA256

                                            08d4b3370723845492a3d5cfbdaaedfa4c7008745ce220aa5bafef16fbb8bfa5

                                            SHA512

                                            e78a5a8f5233f11a3e36262a09c7a1ae8542ea85c60b42da204ee9cb66b492a0043727cb1bd99c73b993a4117f15b3e118ef25f5d7a4ba02eb1cc90f18b5a349

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\7b0d48dbbf50fe239f1097f5d01c2a6d.exe
                                            Filesize

                                            644KB

                                            MD5

                                            6977ca770fc10280a1f5a8ed64659ff6

                                            SHA1

                                            eaa64e282ce1cd09802728b11489a7d3216806f0

                                            SHA256

                                            9cecf0b04e14259f208bc5ff3f61facd6fdf5a589b43379d520f4bd3b4c577a7

                                            SHA512

                                            902d0b3d4e91d13cdd05573585d6534f4f9f989fa3757d3a34def79f1f4900a5c89fea909074a7b2d46b58b56100f02c23f19b841b2f145f2ad9c40d084e9456

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\ABE0.exe
                                            Filesize

                                            133KB

                                            MD5

                                            277308f2fadeff20c58f8564281a9abd

                                            SHA1

                                            e2b21c73983ec49009aebae7904af599b8ab00cc

                                            SHA256

                                            d9b3d201a2422592fc03ddafc6866aac4135492d42753c695158478e59b286bc

                                            SHA512

                                            7059394f60b85e0fc12045a9afb188e4c83356ef1c59c7ccbe31f7a4bd410a629142998c9efc7f9dec5f959f30a93c83f3d5484b2c74d443985e21d2d1a07d53

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\ABE0.exe
                                            Filesize

                                            13KB

                                            MD5

                                            7a288576c7107ff4b9cad76413e6b99b

                                            SHA1

                                            cf278e5351920f1e51402ce59564f45c28e9e081

                                            SHA256

                                            50da254e84c02c3525bc6b157d8d6754b2d05d09788bb67a2194e0193f81ec29

                                            SHA512

                                            806e7d792fa1d37e3b0bacef91252f687ad10ff125c73f6194c7db285097689e7130eee1d72f77f997ec3b7d982b0bdc9863d016982ccd6175387c936e25d2ca

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\C0C1.exe
                                            Filesize

                                            133KB

                                            MD5

                                            ef196c8c8df06c4a75e7774cc1748e2a

                                            SHA1

                                            f2f096e49408e7c4e81a5cf9bb856b14c319fe99

                                            SHA256

                                            f2bec558a9b264fca3f63bb017ad0fb0349da4e03535b729e196a5c89d585b3f

                                            SHA512

                                            c150d6652bc2171525e7d3f490f974b9a9196db19386c3ec6dc216245f21c411269d2f732f07b3ad4a97914947cd7f0ecf37ce65351fe7c2dd322f84dba142b2

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\C0C1.exe
                                            Filesize

                                            81KB

                                            MD5

                                            2beff96cd7c2692b2b6f0db6097e3f17

                                            SHA1

                                            a0bca53591c8f7fe1a04910281b543a0ae8e76e1

                                            SHA256

                                            ed168b394f921cf83e80afdf14b2d3688bd9c46e684ba546b0e473ef96736302

                                            SHA512

                                            d77105753cd57dc0ba759d05cf254394b7debf4b100537be11f0a2cfac5cec018aad6b389e779859ee380fc28453ec6226b7f02e2651f647db69fb89e728c926

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\C0C1.exe
                                            Filesize

                                            86KB

                                            MD5

                                            b80510b4d54eadad7ac753ffb625085b

                                            SHA1

                                            b30f9b2ccb7806967de78c3ea5a0b5cadf267971

                                            SHA256

                                            949caa8b15bce3efff451a1fca41e8f8cfb7f33b25ac7b00b3ea7bd07c2b3cda

                                            SHA512

                                            ce5c09a0f28fe56356b9be0631eb319f3e9626f149db0f2c0f9e391e20dd6cf107613dc170bdfb25cd964f7918ccdaaf03abda768612c63f164e61bf0df7771c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\C0C1.exe
                                            Filesize

                                            1KB

                                            MD5

                                            45300fc68a9f8236c25360b62139eab7

                                            SHA1

                                            bc12b28dfb0654cc5400e1a5b836b0fb9c7c5a75

                                            SHA256

                                            ce10bae62c591ccc5171b909b5bcec1ca6ec513c6af1817364016afbba84e65b

                                            SHA512

                                            35959be17282b0aadc55c943f9ece7b574bfa02046d339847b2c02f5ef33b50ae45e3d9fb0a0b81bfd6a02061d1205078c8c5e174e2cfe5167e5f3e3ffca7135

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\C0C1.exe
                                            Filesize

                                            269KB

                                            MD5

                                            84b020e6252f6145641f3dde85604010

                                            SHA1

                                            a07b329480dec04c2a2e49edd403690f245607f4

                                            SHA256

                                            d6ae2b756cf710e14a2dec613260facae8f12abfdcd08450dd4f9bbe9ec289b9

                                            SHA512

                                            391a3a479f754524d5886c4f54f29cea914cffe5cb0aabd59b20844db63ad4980f95c873a8cbd8337f8f820c8aa815f3025f2d34ec6a84258238ebef83064a59

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\D7A5.exe
                                            Filesize

                                            154KB

                                            MD5

                                            b2da4f5ed3448c4c6d7033797b4c9ce1

                                            SHA1

                                            87937808899ceada415a5e2fb9442ee55a1ca02e

                                            SHA256

                                            30222cfc9509aab1be1b6056bb17c31f6635b1868fd6eea9093270b8eee8fff8

                                            SHA512

                                            13d910af6dd2b6faa6b46fa18b0b851bfaef5e51894273348fc1222386f3b30e968abfe15bbb736d069f9f4fc1eaa7162e0ecade382b73ee2f16cc9933a5c67f

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\D7A5.exe
                                            Filesize

                                            190KB

                                            MD5

                                            220644cd0b33f87ba201d82f2b86c2e5

                                            SHA1

                                            cd408956c48493683845b28f15ac1dba5ad521b0

                                            SHA256

                                            62c292d268eb99f68a31d3bc32219d4460c573e251c59702a9e3576ce0a26127

                                            SHA512

                                            aba07e7099069e0f6fe66a3554c88375298db8330305bb91393dd51bea952c3fe422ebb2ae2d0a066a6ac63608483ba89ba86a99d3488391e9674bfed97c16ad

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\E1F7.exe
                                            Filesize

                                            111KB

                                            MD5

                                            f55df846d5bb15bf95c344c5d243da29

                                            SHA1

                                            a0e208e8584f6ad5d2180719cab02ab300f1b535

                                            SHA256

                                            60923817e738b067b7eac1a77c1b94c612d123bd80221c98cff0c19aae4d34e3

                                            SHA512

                                            18b3b25e2c790cf7cc59c8d958d5130e0ab8102121e5625bb85e7671c147caad1ca7b23bd82043ba5fb2a54fc12514de3ca92e131077213465073a606a593db5

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\E1F7.exe
                                            Filesize

                                            120KB

                                            MD5

                                            c3e03c186dd2db0c0293c5cf181f13ba

                                            SHA1

                                            44a859cc00e2f5334e9598648b320abe5dd6a7d1

                                            SHA256

                                            33d24ff47d0b57b15075aa2e4b66c561dd91ad4a4a8c9184fb10be005ff88545

                                            SHA512

                                            2bfe062fa352b47023b49866cc23454ab62838146f50c7017dc79fcead718c87ed9109b413acfcfaef18234ba8f730b195eb14858ead33056ea2be78c2656ad1

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\FirstZ.exe
                                            Filesize

                                            244KB

                                            MD5

                                            a2495916fb7ec1fa880f7d531bfd18d9

                                            SHA1

                                            9e81c7a604d470c74f2d446130db5d92d2dee256

                                            SHA256

                                            70ee77197fecf8d1260a6ae5a7bee4d5f0c0de895610fc10a220a76858e73482

                                            SHA512

                                            e375f96ab2ae1b5ad825a91b083342ff64d633a79a4622897285512913d16d48c72268c6f14662cfe88ba071a80e4f1d268774a460a7c0728d1663f2a34ce100

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\FirstZ.exe
                                            Filesize

                                            290KB

                                            MD5

                                            b1f4535654c1e75519c11c358777085b

                                            SHA1

                                            00acfcb302581b8636c525c8f7b6b9ab11474d79

                                            SHA256

                                            fedfe9ad6071b61d1c2c9c5ae7746ba42ffec6681616126d6db96cc7d09ad6a6

                                            SHA512

                                            73c38877075939b0b25fcf1458e54d4ee16918317d1dfbe9b29f7e5197a1013927f848ef2ae8ad1cbe764721773700a55c80e149401e49f3ccbfeafab25d137c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\FirstZ.exe
                                            Filesize

                                            356KB

                                            MD5

                                            5f55aacd144cce3f3e3f6f771d7b99a4

                                            SHA1

                                            3d686e487bc3de2a44f2193271116cc4a5dda980

                                            SHA256

                                            c55094422fa99193800d5a2227fce31bc8a0528c57b848fcfdb5cc6821f422e9

                                            SHA512

                                            97c025bf0814a9e42bcbd4546ffb0bdd7ece64251eeafcb1937f1d9546cbacb4ff51087daf00d6fa083d1a1d2170ccb37ca0deaf0f3c83ec16c7ef6f2a74946c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat
                                            Filesize

                                            35B

                                            MD5

                                            ff59d999beb970447667695ce3273f75

                                            SHA1

                                            316fa09f467ba90ac34a054daf2e92e6e2854ff8

                                            SHA256

                                            065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2

                                            SHA512

                                            d5ac72cb065a3cd3cb118a69a2f356314eeed24dcb4880751e1a3683895e66cedc62607967e29f77a0c27adf1c9fe0efd86e804f693f0a63a5b51b0bf0056b5d

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
                                            Filesize

                                            78KB

                                            MD5

                                            5fc6a891686e7ea02b9682135e09c26b

                                            SHA1

                                            f19d36118b999eef5d6f9d9774c7c160ee3c9f92

                                            SHA256

                                            6cc9160fa1fa197f4c6b101b69c2c9c3054863d43ab4e54adc6ab86448381621

                                            SHA512

                                            7cfc667021f4ae8a17b6ed7dbebfe9a82ba10dbf7528ff14dd60ea3a59a5dee37223882fcf8ece8372f520cdc0f8d49ca976f2f653e6d40b0d0bd416efd10abc

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
                                            Filesize

                                            141KB

                                            MD5

                                            03a095168dcee53013a57adee093d89b

                                            SHA1

                                            1d6fd1695296a112aefd3a2e954ec1a456cc1a14

                                            SHA256

                                            8e271915b9bc120cee68c7d02e76d146caff01b3234b35a3f9951c50cdc4e841

                                            SHA512

                                            9fef55a09007c4e9747ea19f549d8a4a4e207c98627e726139467eef8ef19e5fed7b1a3b60a1bdb60168e2eec731bf9dda707b014229e16e3a9239ab79be0573

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesa.exe
                                            Filesize

                                            214KB

                                            MD5

                                            0951110588c48008752707ea2c92336b

                                            SHA1

                                            c4d655377de5d18ef8d965625b735ddc9cee172d

                                            SHA256

                                            65742e0ee8ae678b07110d9dadd5f8e357afc337ec0452fb9d096e51b939db1c

                                            SHA512

                                            643a0726c70a114e21cfb6fae5cd9f530d710947c7eafbd0ce22d5e4093d042b306d4a423d270b3feb0be4897bed9b31415fd52f078080859aed64e65222ff14

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesa.exe
                                            Filesize

                                            141KB

                                            MD5

                                            72170656790a38f43a565ddd1a634e0d

                                            SHA1

                                            c76e513a324c6d9bbe428966cff906fecae8c49f

                                            SHA256

                                            907d07682dd06b2a9e6ef49e5d31719ebd126678ebf410bbbdc016369d800f8f

                                            SHA512

                                            93085bd1abe39d319d78dfa4e0a585841115eecacd941a23fb7f01b32cb1ecdbddcd916b0b872c0e76b6b2aa20b226f22b8ada66ec146a7b430950b700a9caab

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\fesa.exe
                                            Filesize

                                            122KB

                                            MD5

                                            e0481ab0fef983abba2b8ae8dbc38113

                                            SHA1

                                            52ed6e21e08449f55644542296754c014f175838

                                            SHA256

                                            924cc0801d18c04ddbc359ba94a9a53f26d6c2b2ad3162179ab1697d7d437d75

                                            SHA512

                                            2f0b72a7de88d46def6ede95c1b9cddf756936ae5e8fa898f500b072593e4ff23f44cc65c73a84c3d1d6c58c130a1fa36d44b6b3b21d93ccee13af9532e78771

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kj3fqja4.pfn.ps1
                                            Filesize

                                            60B

                                            MD5

                                            d17fe0a3f47be24a6453e9ef58c94641

                                            SHA1

                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                            SHA256

                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                            SHA512

                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                            Filesize

                                            67KB

                                            MD5

                                            0d9d80485bb6f2b2435adfcafce97294

                                            SHA1

                                            0158aeea1cf672f3e52ce98e0f58bbd0608537d5

                                            SHA256

                                            d996a4212ac867dde989ac50fc88506b4d7bdf6bc60e8f6f343561c88b9cbc7f

                                            SHA512

                                            188811d04b34b1a41e087853041feef1ecbbf6049f5860c27f583f4ae673b1d14533534bc087fe2dc41f7395f629b419fc5e296296add9f52704058db3a7aa7b

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                            Filesize

                                            135KB

                                            MD5

                                            e7d603581d1715380fcf1ab279e9de08

                                            SHA1

                                            eba59dd71f33508f40a33772709c9070d48002e7

                                            SHA256

                                            9e7ea60913f16812af3dddb0be818c5a391331fd27d1b355c31999a907403769

                                            SHA512

                                            e50ac7d984f42d28afbf67cca8e43206282b903ea734dccc84811a113f14aa3b13121740014cbee3599abf37c8eaa66d9c7653383ff46aa25d044e5f68184b46

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\rty25.exe
                                            Filesize

                                            715KB

                                            MD5

                                            0b374be36fee0eae8b1e305f1e4073f5

                                            SHA1

                                            3e5f24441b9f00c3e5beb7ef2438d1868259d852

                                            SHA256

                                            bbd48c58bc41696a56c317d9650057c725642e5c1dee71a8b4f0b9cbd9095ad4

                                            SHA512

                                            f8abf77020dfe9cba6c8afb6535a86338a8923dac7d3a81ce78110302708611109c3b80104178ec6dcd95ce7d9e60829fa8b88c7411aa726699aec04eaaccb9c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\rty25.exe
                                            Filesize

                                            621KB

                                            MD5

                                            be936129997a04802918052d19c93aac

                                            SHA1

                                            e0b1011b4bb2c5585536b6cab879c26b56ea775b

                                            SHA256

                                            acd2980b06b55eb7a6adc6054770b8573eb725de356f28598a15bcf8e7aabeaa

                                            SHA512

                                            bfc4d76312911c8b5715e59900e2b245fb64e2548c04da5049b7440cb43032796304aa3824fd974785a11d6c3dd652218b10f11d44a3292d9f8c2a2068662ef4

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\rty25.exe
                                            Filesize

                                            579KB

                                            MD5

                                            e4412f19bc0958f8839747b727832c93

                                            SHA1

                                            ebbc3e9db7d5ecbdfa65e4a5a50ba03419c00c99

                                            SHA256

                                            20d4fcf7c8b09b2096e62e810630ebc98b3cc7d26d7d2fae4d0e5eb4931a7e89

                                            SHA512

                                            4a447e0192da1dc621eaa9176dc845ae3e24e0926e47dfa7a4d531b4159bac1c61b6081f36b39a5d236a50209b9fde160b95c07cd456e344e81d44a13dad8f24

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
                                            Filesize

                                            175KB

                                            MD5

                                            01fb175d82c6078ebfe27f5de4d8d2aa

                                            SHA1

                                            ff655d5908a109af47a62670ff45008cc9e430c4

                                            SHA256

                                            a07112e236e0136b43294b31a43fb4456072941a135853e761680d04315841c3

                                            SHA512

                                            c388d632c5274aa47d605f3c49a6754d4ad581eb375c54ce82424cffa2ad86410a2ad646867a571dcf153e494b4e7ca7a7cf6952b99ddcf5940a443f7039f2fe

                                            Download Submit

                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                            Filesize

                                            2KB

                                            MD5

                                            3d086a433708053f9bf9523e1d87a4e8

                                            SHA1

                                            b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                                            SHA256

                                            6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                                            SHA512

                                            931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                                            Download Submit

                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                            Filesize

                                            19KB

                                            MD5

                                            0587e4f1c8a078ee9ad84910edd02a23

                                            SHA1

                                            d05130885965c40a77613ca42719fe28acf148b6

                                            SHA256

                                            7d6e9f69e4f16e5005dac6235703e51d6a44842a2e7522a7ef1aabc12d235d7f

                                            SHA512

                                            46d9577cd725f925988b8e12593808b52c9d8d1bba19c4c043de219eb25e9fecb40a2ae0ab7aea0ef4e4c55c641625cc1b641cc3933a29bed8281d32c9e880e7

                                            Download Submit

                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                            Filesize

                                            19KB

                                            MD5

                                            d4b578fc218daaddd62c3ecc0d4fa66b

                                            SHA1

                                            d71d55fd2d45f9e6d5d9e4d101d6d789134fa842

                                            SHA256

                                            ee6fbbab815bbacca304495a927629c13123c91b16f50d34b9a97696e37c1315

                                            SHA512

                                            ca25f12793fe4c2a1f708e3ed991ab32634435154775820bfa82744ae87bce6d21c111f30fe45b886545f936fea84186317581d66d7d5b7677fb3f4c662e3f92

                                            Download Submit

                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                            Filesize

                                            19KB

                                            MD5

                                            3d11fcb2921b39a58f4ee3ea0acc75ee

                                            SHA1

                                            688d9d315da84a72af2140fa698cf6e0741c321c

                                            SHA256

                                            03fc827dd29994f8d8d263d1044fe37998fcd1785db3ed621fe3c1b37d617237

                                            SHA512

                                            4ea47e641ff1820ebdc6b09722f21a9acd73e8d1133326e7ba2a3ee0e6bed2fa5ac8166b98f877f53e4003253d6c1016602d156694963c8f0c4d7646fa70927a

                                            Download Submit

                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                            Filesize

                                            19KB

                                            MD5

                                            308bdace939369362f9fd1d4c5cc9453

                                            SHA1

                                            40b141ee55cc01c81adf402bde69860478785339

                                            SHA256

                                            d9c26d90c207a8f296fdcfd27ce0cedc4f4b331cb4e603dac779de46b7ed5cdd

                                            SHA512

                                            cd7ad3978698b767b13b09de57ebc83786d8a6e1a05b76d07680674570e4c188f80390c2fb0a799015a80f5bd9c2285d7c46590b501f31eff7c51984fa45fc5d

                                            Download Submit

                                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                            Filesize

                                            19KB

                                            MD5

                                            49ef12aad122bb5e09484526cbb4ed5b

                                            SHA1

                                            5ee1fb9189e4ba412bdee18d6c1399a6cd192edc

                                            SHA256

                                            5df482384d8f0e8d95035861b7a1e08fa7dc557a7d5fab63a02caff007b35459

                                            SHA512

                                            0fa8f2ffef88c5683931af03fc2c9211f0f6079bc03199df23d22feff08e3b161d8490285d0828b0fda8158313530cac6f43d9d9ca76496db470be379777d7e3

                                            Download Submit

                                          • C:\Windows\rss\csrss.exe
                                            Filesize

                                            95KB

                                            MD5

                                            24ad1df4633fd27f614f0c1ec9620004

                                            SHA1

                                            d49c4dd89eb521604d382b362284b46211ddb08e

                                            SHA256

                                            f47f0343d1754e046a01517685acbaafca6251a37ca054047f186999ca271782

                                            SHA512

                                            1f4d25040165e0d48e9814083c92112411a32f8b546edaad1d691eaac4dc3ff4ca94e45bf3a56f04df0b84c509e6e6179baccf892f6b7f9f80b3845a42efc952

                                            Download Submit

                                          • C:\Windows\rss\csrss.exe
                                            Filesize

                                            76KB

                                            MD5

                                            d931a6eefa89454274b19527f8b01465

                                            SHA1

                                            d22f10d3c58e889558d4d16e7f5cc1fc16690487

                                            SHA256

                                            1e8587316705fb71280c5d309e234315c286ae9f668e93ce4b1d2e8b00405cac

                                            SHA512

                                            a6605c304056270af674044020590beb0d7fb11a4701cfeaa9cfc7b3144041bb00990f17bb6ca550da482ef1a9e0969a6a51a8680417af4526126e06b030dae6

                                            Download Submit

                                          • C:\Windows\windefender.exe
                                            Filesize

                                            88KB

                                            MD5

                                            0b0d453153c1b616ff67314d7a0b4aa9

                                            SHA1

                                            5ca3b99be38e8bfead31cf397657f0f37289579a

                                            SHA256

                                            4da739ef9de89a4c01fd9a060d7041d0642b5297a293d769d39f27ccc39f3dea

                                            SHA512

                                            a57da7aadec20aa052a20c72f5a25b8fcec079a005a70a985329221ef928c1f4f05d87b44f63128d3625645e84086983f4c7338737bbaf41d51233b1eb4bb818

                                            Download Submit

                                          • C:\Windows\windefender.exe
                                            Filesize

                                            92KB

                                            MD5

                                            df987deace3fc06e593e47b66a1b6518

                                            SHA1

                                            ee77ea765923b91a8a2434b76b1a631c8a64951c

                                            SHA256

                                            6635cb4db4db69fa34811d05891414991737fa439e9f92d16ff7a75a12558b23

                                            SHA512

                                            a99a63bf35cbcd0ca947ea223282ca4fcfb295b4a2e6b7f3a8afef4b32b196a5b593dd8073443307215bad0934075d3afff8d3496da12b63b4ee8afdfe44dda9

                                            Download Submit

                                          • C:\Windows\windefender.exe
                                            Filesize

                                            57KB

                                            MD5

                                            5c51141aabd9883165118bd6e2096a7d

                                            SHA1

                                            e753dc7fc9ded6241eacd9b54f82ceeaed9423e6

                                            SHA256

                                            6fbdaf9c44527d844280c051a6ca2d8b32b709ee2e1b49b096a6c56bbd55571e

                                            SHA512

                                            4f7f8fb69943d82385398b358ecb168385d5bd586927f4428c0fd7233734dfd2b6379e097cf2f5462dd6cd7ccd46acb1ae5b6a911947e373c922539f566e2a1d

                                            Download Submit

                                          • memory/1676-48-0x0000000003350000-0x000000000374D000-memory.dmp

                                            Filesize

                                            4.0MB

                                            Download

                                          • memory/1676-103-0x0000000000400000-0x0000000002EE6000-memory.dmp

                                            Filesize

                                            42.9MB

                                            Download

                                          • memory/1676-51-0x0000000004EF0000-0x00000000057DB000-memory.dmp

                                            Filesize

                                            8.9MB

                                            Download

                                          • memory/1676-53-0x0000000000400000-0x0000000002EE6000-memory.dmp

                                            Filesize

                                            42.9MB

                                            Download

                                          • memory/1824-495-0x0000000004FA0000-0x0000000004FD3000-memory.dmp

                                            Filesize

                                            204KB

                                            Download

                                          • memory/1824-490-0x0000000004FA0000-0x0000000004FD3000-memory.dmp

                                            Filesize

                                            204KB

                                            Download

                                          • memory/1824-492-0x0000000004FA0000-0x0000000004FD3000-memory.dmp

                                            Filesize

                                            204KB

                                            Download

                                          • memory/1824-487-0x0000000004FA0000-0x0000000004FD3000-memory.dmp

                                            Filesize

                                            204KB

                                            Download

                                          • memory/1824-499-0x0000000004FA0000-0x0000000004FD3000-memory.dmp

                                            Filesize

                                            204KB

                                            Download

                                          • memory/1824-488-0x0000000004FA0000-0x0000000004FD3000-memory.dmp

                                            Filesize

                                            204KB

                                            Download

                                          • memory/1824-497-0x0000000004FA0000-0x0000000004FD3000-memory.dmp

                                            Filesize

                                            204KB

                                            Download

                                          • memory/1824-501-0x0000000004FA0000-0x0000000004FD3000-memory.dmp

                                            Filesize

                                            204KB

                                            Download

                                          • memory/2120-436-0x0000000140000000-0x000000014000E000-memory.dmp

                                            Filesize

                                            56KB

                                            Download

                                          • memory/2120-432-0x0000000140000000-0x000000014000E000-memory.dmp

                                            Filesize

                                            56KB

                                            Download

                                          • memory/2120-430-0x0000000140000000-0x000000014000E000-memory.dmp

                                            Filesize

                                            56KB

                                            Download

                                          • memory/2120-431-0x0000000140000000-0x000000014000E000-memory.dmp

                                            Filesize

                                            56KB

                                            Download

                                          • memory/2120-433-0x0000000140000000-0x000000014000E000-memory.dmp

                                            Filesize

                                            56KB

                                            Download

                                          • memory/2120-434-0x0000000140000000-0x000000014000E000-memory.dmp

                                            Filesize

                                            56KB

                                            Download

                                          • memory/2140-137-0x0000000006DD0000-0x0000000006E73000-memory.dmp

                                            Filesize

                                            652KB

                                            Download

                                          • memory/2140-108-0x0000000074190000-0x0000000074940000-memory.dmp

                                            Filesize

                                            7.7MB

                                            Download

                                          • memory/2140-139-0x00000000071C0000-0x0000000007256000-memory.dmp

                                            Filesize

                                            600KB

                                            Download

                                          • memory/2140-126-0x000000006FF10000-0x000000006FF5C000-memory.dmp

                                            Filesize

                                            304KB

                                            Download

                                          • memory/2140-127-0x0000000070470000-0x00000000707C4000-memory.dmp

                                            Filesize

                                            3.3MB

                                            Download

                                          • memory/2140-141-0x0000000007130000-0x000000000713E000-memory.dmp

                                            Filesize

                                            56KB

                                            Download

                                          • memory/2140-138-0x00000000025A0000-0x00000000025B0000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/2140-125-0x000000007F460000-0x000000007F470000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/2140-124-0x0000000005BC0000-0x0000000005C0C000-memory.dmp

                                            Filesize

                                            304KB

                                            Download

                                          • memory/2140-140-0x00000000070F0000-0x0000000007101000-memory.dmp

                                            Filesize

                                            68KB

                                            Download

                                          • memory/2140-119-0x0000000005550000-0x00000000058A4000-memory.dmp

                                            Filesize

                                            3.3MB

                                            Download

                                          • memory/2140-142-0x0000000007140000-0x0000000007154000-memory.dmp

                                            Filesize

                                            80KB

                                            Download

                                          • memory/2140-109-0x00000000025A0000-0x00000000025B0000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/2140-107-0x00000000025A0000-0x00000000025B0000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/2140-144-0x0000000007170000-0x0000000007178000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/2140-143-0x0000000007180000-0x000000000719A000-memory.dmp

                                            Filesize

                                            104KB

                                            Download

                                          • memory/2140-147-0x0000000074190000-0x0000000074940000-memory.dmp

                                            Filesize

                                            7.7MB

                                            Download

                                          • memory/2204-450-0x0000000140000000-0x0000000140848000-memory.dmp

                                            Filesize

                                            8.3MB

                                            Download

                                          • memory/2204-439-0x0000000140000000-0x0000000140848000-memory.dmp

                                            Filesize

                                            8.3MB

                                            Download

                                          • memory/2204-445-0x0000000001960000-0x0000000001980000-memory.dmp

                                            Filesize

                                            128KB

                                            Download

                                          • memory/2204-447-0x0000000140000000-0x0000000140848000-memory.dmp

                                            Filesize

                                            8.3MB

                                            Download

                                          • memory/2204-446-0x0000000140000000-0x0000000140848000-memory.dmp

                                            Filesize

                                            8.3MB

                                            Download

                                          • memory/2204-443-0x0000000140000000-0x0000000140848000-memory.dmp

                                            Filesize

                                            8.3MB

                                            Download

                                          • memory/2204-442-0x0000000140000000-0x0000000140848000-memory.dmp

                                            Filesize

                                            8.3MB

                                            Download

                                          • memory/2204-449-0x0000000140000000-0x0000000140848000-memory.dmp

                                            Filesize

                                            8.3MB

                                            Download

                                          • memory/2204-448-0x0000000140000000-0x0000000140848000-memory.dmp

                                            Filesize

                                            8.3MB

                                            Download

                                          • memory/2204-444-0x0000000140000000-0x0000000140848000-memory.dmp

                                            Filesize

                                            8.3MB

                                            Download

                                          • memory/2204-441-0x0000000140000000-0x0000000140848000-memory.dmp

                                            Filesize

                                            8.3MB

                                            Download

                                          • memory/2204-440-0x0000000140000000-0x0000000140848000-memory.dmp

                                            Filesize

                                            8.3MB

                                            Download

                                          • memory/2204-438-0x0000000140000000-0x0000000140848000-memory.dmp

                                            Filesize

                                            8.3MB

                                            Download

                                          • memory/2216-465-0x0000000000400000-0x000000000048A000-memory.dmp

                                            Filesize

                                            552KB

                                            Download

                                          • memory/2216-469-0x0000000000400000-0x000000000048A000-memory.dmp

                                            Filesize

                                            552KB

                                            Download

                                          • memory/2272-150-0x0000000002CC0000-0x0000000002DCB000-memory.dmp

                                            Filesize

                                            1.0MB

                                            Download

                                          • memory/2272-151-0x0000000002F00000-0x000000000302E000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/2272-52-0x00007FF6BFAA0000-0x00007FF6BFB57000-memory.dmp

                                            Filesize

                                            732KB

                                            Download

                                          • memory/2644-336-0x0000000000400000-0x00000000008DF000-memory.dmp

                                            Filesize

                                            4.9MB

                                            Download

                                          • memory/2996-1-0x0000000000CD0000-0x0000000001450000-memory.dmp

                                            Filesize

                                            7.5MB

                                            Download

                                          • memory/2996-50-0x00000000743F0000-0x0000000074BA0000-memory.dmp

                                            Filesize

                                            7.7MB

                                            Download

                                          • memory/2996-0-0x00000000743F0000-0x0000000074BA0000-memory.dmp

                                            Filesize

                                            7.7MB

                                            Download

                                          • memory/3152-349-0x0000000000400000-0x0000000000537000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/3152-352-0x0000000000400000-0x0000000000537000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/3152-347-0x0000000000400000-0x0000000000537000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/3152-362-0x0000000000400000-0x0000000000537000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/3532-338-0x0000000002DE0000-0x0000000002DF6000-memory.dmp

                                            Filesize

                                            88KB

                                            Download

                                          • memory/3532-120-0x0000000002DC0000-0x0000000002DD6000-memory.dmp

                                            Filesize

                                            88KB

                                            Download

                                          • memory/4396-378-0x0000000000400000-0x0000000002EE6000-memory.dmp

                                            Filesize

                                            42.9MB

                                            Download

                                          • memory/4396-322-0x0000000000400000-0x0000000002EE6000-memory.dmp

                                            Filesize

                                            42.9MB

                                            Download

                                          • memory/4552-369-0x0000000000400000-0x0000000000537000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/4552-372-0x0000000000400000-0x0000000000537000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/4552-370-0x0000000000400000-0x0000000000537000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/4560-59-0x00000000052F0000-0x0000000005312000-memory.dmp

                                            Filesize

                                            136KB

                                            Download

                                          • memory/4560-75-0x0000000006290000-0x00000000062AE000-memory.dmp

                                            Filesize

                                            120KB

                                            Download

                                          • memory/4560-54-0x0000000002CD0000-0x0000000002D06000-memory.dmp

                                            Filesize

                                            216KB

                                            Download

                                          • memory/4560-82-0x0000000007CD0000-0x000000000834A000-memory.dmp

                                            Filesize

                                            6.5MB

                                            Download

                                          • memory/4560-55-0x00000000741E0000-0x0000000074990000-memory.dmp

                                            Filesize

                                            7.7MB

                                            Download

                                          • memory/4560-81-0x00000000075D0000-0x0000000007646000-memory.dmp

                                            Filesize

                                            472KB

                                            Download

                                          • memory/4560-58-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/4560-83-0x0000000007670000-0x000000000768A000-memory.dmp

                                            Filesize

                                            104KB

                                            Download

                                          • memory/4560-56-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/4560-57-0x0000000005500000-0x0000000005B28000-memory.dmp

                                            Filesize

                                            6.2MB

                                            Download

                                          • memory/4560-60-0x0000000005BA0000-0x0000000005C06000-memory.dmp

                                            Filesize

                                            408KB

                                            Download

                                          • memory/4560-66-0x0000000005C80000-0x0000000005CE6000-memory.dmp

                                            Filesize

                                            408KB

                                            Download

                                          • memory/4560-100-0x00000000741E0000-0x0000000074990000-memory.dmp

                                            Filesize

                                            7.7MB

                                            Download

                                          • memory/4560-85-0x0000000007830000-0x0000000007862000-memory.dmp

                                            Filesize

                                            200KB

                                            Download

                                          • memory/4560-86-0x000000006FEB0000-0x000000006FEFC000-memory.dmp

                                            Filesize

                                            304KB

                                            Download

                                          • memory/4560-97-0x0000000007870000-0x000000000788E000-memory.dmp

                                            Filesize

                                            120KB

                                            Download

                                          • memory/4560-99-0x0000000007980000-0x000000000798A000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/4560-98-0x0000000007890000-0x0000000007933000-memory.dmp

                                            Filesize

                                            652KB

                                            Download

                                          • memory/4560-87-0x0000000070030000-0x0000000070384000-memory.dmp

                                            Filesize

                                            3.3MB

                                            Download

                                          • memory/4560-84-0x000000007FBF0000-0x000000007FC00000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/4560-71-0x0000000005E70000-0x00000000061C4000-memory.dmp

                                            Filesize

                                            3.3MB

                                            Download

                                          • memory/4560-76-0x00000000062F0000-0x000000000633C000-memory.dmp

                                            Filesize

                                            304KB

                                            Download

                                          • memory/4560-80-0x0000000006810000-0x0000000006854000-memory.dmp

                                            Filesize

                                            272KB

                                            Download

                                          • memory/4576-154-0x0000000004B30000-0x0000000004B40000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/4576-179-0x0000000007110000-0x00000000071B3000-memory.dmp

                                            Filesize

                                            652KB

                                            Download

                                          • memory/4576-166-0x00000000060E0000-0x000000000612C000-memory.dmp

                                            Filesize

                                            304KB

                                            Download

                                          • memory/4576-168-0x0000000070980000-0x00000000709CC000-memory.dmp

                                            Filesize

                                            304KB

                                            Download

                                          • memory/4576-153-0x0000000074190000-0x0000000074940000-memory.dmp

                                            Filesize

                                            7.7MB

                                            Download

                                          • memory/4576-167-0x000000007FC30000-0x000000007FC40000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/4576-169-0x0000000070470000-0x00000000707C4000-memory.dmp

                                            Filesize

                                            3.3MB

                                            Download

                                          • memory/4576-155-0x0000000004B30000-0x0000000004B40000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/4628-339-0x0000000000400000-0x0000000002B04000-memory.dmp

                                            Filesize

                                            39.0MB

                                            Download

                                          • memory/4648-17-0x0000000002C50000-0x0000000002D50000-memory.dmp

                                            Filesize

                                            1024KB

                                            Download

                                          • memory/4648-37-0x0000000000400000-0x0000000002B04000-memory.dmp

                                            Filesize

                                            39.0MB

                                            Download

                                          • memory/4648-18-0x0000000002B50000-0x0000000002B5B000-memory.dmp

                                            Filesize

                                            44KB

                                            Download

                                          • memory/4648-121-0x0000000000400000-0x0000000002B04000-memory.dmp

                                            Filesize

                                            39.0MB

                                            Download

                                          • memory/4732-104-0x00000000032B0000-0x00000000036B5000-memory.dmp

                                            Filesize

                                            4.0MB

                                            Download

                                          • memory/4732-220-0x0000000000400000-0x0000000002EE6000-memory.dmp

                                            Filesize

                                            42.9MB

                                            Download

                                          • memory/4732-182-0x0000000000400000-0x0000000002EE6000-memory.dmp

                                            Filesize

                                            42.9MB

                                            Download

                                          • memory/4732-105-0x0000000004E60000-0x000000000574B000-memory.dmp

                                            Filesize

                                            8.9MB

                                            Download

                                          • memory/4732-106-0x0000000000400000-0x0000000002EE6000-memory.dmp

                                            Filesize

                                            42.9MB

                                            Download