Analysis

  • max time kernel
    123s
  • max time network
    299s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28-03-2024 22:32

General

  • Target

    6cbc335731e0a3100d3c9a835a335a5f4cd2869e19431141ba3d47b8443ae678.exe

  • Size

    1.8MB

  • MD5

    1c05d457318827e3fb0ac2d7c55679e7

  • SHA1

    196962c56d7b1fc7a9418a11610999aceb48b5fa

  • SHA256

    6cbc335731e0a3100d3c9a835a335a5f4cd2869e19431141ba3d47b8443ae678

  • SHA512

    e9df1bf4a09fd22ebed1a478c97b58724360c052c70568fab01c94af0fb185bc8474b17af9d1d8a5ebf26d170a5c34e161875cf012c3fab9a5ab7d5f71b39d3c

  • SSDEEP

    49152:bohZLOIMPTb7UkS59UJ/CKNrIX5cV+/KyNNIEJip:sHy5f7UkSLUQmrs3ROES

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

redline

Botnet

@OLEH_PSP

C2

185.172.128.33:8970

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect ZGRat V1 3 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 4 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Stops running service(s) 3 TTPs
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 25 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 6 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 10 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6cbc335731e0a3100d3c9a835a335a5f4cd2869e19431141ba3d47b8443ae678.exe
    "C:\Users\Admin\AppData\Local\Temp\6cbc335731e0a3100d3c9a835a335a5f4cd2869e19431141ba3d47b8443ae678.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:216
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2888
      • C:\Users\Admin\AppData\Local\Temp\1000042001\e8741b9d71.exe
        "C:\Users\Admin\AppData\Local\Temp\1000042001\e8741b9d71.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:2652
      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
        "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
        3⤵
          PID:2992
        • C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
          "C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2404
        • C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
          "C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          PID:5844
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          PID:1200
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:1772
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3416
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:956
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4048
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1520
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:5068
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:216
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:1388
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:5152
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:5592
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:4108
    • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
      C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5548
      • C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe
        "C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:5896
      • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
        "C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:6116
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1184
          • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
            "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:712
          • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
            "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
            4⤵
            • Executes dropped EXE
            • Modifies system certificate store
            PID:4300
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
            4⤵
              PID:6272
              • C:\Windows\SysWOW64\choice.exe
                choice /C Y /N /D Y /T 3
                5⤵
                  PID:660
          • C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe
            "C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"
            2⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:5260
          • C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
            "C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:6036
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
            2⤵
            • Loads dropped DLL
            PID:404
            • C:\Windows\system32\rundll32.exe
              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
              3⤵
              • Blocklisted process makes network request
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              PID:5468
              • C:\Windows\system32\netsh.exe
                netsh wlan show profiles
                4⤵
                  PID:760
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\104443672357_Desktop.zip' -CompressionLevel Optimal
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2808
            • C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
              "C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5832
            • C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe
              "C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe"
              2⤵
              • Executes dropped EXE
              PID:5508
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe" /F
                3⤵
                • Creates scheduled task(s)
                PID:2164
              • C:\Users\Admin\AppData\Local\Temp\1000180001\ISetup8.exe
                "C:\Users\Admin\AppData\Local\Temp\1000180001\ISetup8.exe"
                3⤵
                • Executes dropped EXE
                PID:6076
                • C:\Users\Admin\AppData\Local\Temp\u4os.0.exe
                  "C:\Users\Admin\AppData\Local\Temp\u4os.0.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5336
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\CGIEGHJEGH.exe"
                    5⤵
                      PID:2680
                      • C:\Users\Admin\AppData\Local\Temp\CGIEGHJEGH.exe
                        "C:\Users\Admin\AppData\Local\Temp\CGIEGHJEGH.exe"
                        6⤵
                          PID:6544
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\CGIEGHJEGH.exe
                            7⤵
                              PID:5564
                              • C:\Windows\SysWOW64\PING.EXE
                                ping 2.2.2.2 -n 1 -w 3000
                                8⤵
                                • Runs ping.exe
                                PID:2792
                      • C:\Users\Admin\AppData\Local\Temp\u4os.1.exe
                        "C:\Users\Admin\AppData\Local\Temp\u4os.1.exe"
                        4⤵
                        • Executes dropped EXE
                        • Checks SCSI registry key(s)
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:5088
                        • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                          "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                          5⤵
                            PID:6440
                      • C:\Users\Admin\AppData\Local\Temp\1000181001\toolspub1.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000181001\toolspub1.exe"
                        3⤵
                        • Executes dropped EXE
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: MapViewOfSection
                        PID:6120
                      • C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"
                        3⤵
                        • Executes dropped EXE
                        PID:5020
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          4⤵
                            PID:6512
                          • C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"
                            4⤵
                              PID:3592
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                5⤵
                                  PID:2416
                                • C:\Windows\System32\cmd.exe
                                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                  5⤵
                                    PID:1684
                                    • C:\Windows\system32\netsh.exe
                                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                      6⤵
                                      • Modifies Windows Firewall
                                      PID:6896
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -nologo -noprofile
                                    5⤵
                                      PID:372
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -nologo -noprofile
                                      5⤵
                                        PID:6668
                                      • C:\Windows\rss\csrss.exe
                                        C:\Windows\rss\csrss.exe
                                        5⤵
                                          PID:1460
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -nologo -noprofile
                                            6⤵
                                              PID:1876
                                            • C:\Windows\SYSTEM32\schtasks.exe
                                              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                              6⤵
                                              • Creates scheduled task(s)
                                              PID:5812
                                            • C:\Windows\SYSTEM32\schtasks.exe
                                              schtasks /delete /tn ScheduledUpdate /f
                                              6⤵
                                                PID:6748
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -nologo -noprofile
                                                6⤵
                                                  PID:2044
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -nologo -noprofile
                                                  6⤵
                                                    PID:5492
                                                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                    C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                                    6⤵
                                                      PID:5020
                                                    • C:\Windows\SYSTEM32\schtasks.exe
                                                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                      6⤵
                                                      • Creates scheduled task(s)
                                                      PID:1644
                                                    • C:\Windows\windefender.exe
                                                      "C:\Windows\windefender.exe"
                                                      6⤵
                                                        PID:1388
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                          7⤵
                                                            PID:4360
                                                            • C:\Windows\SysWOW64\sc.exe
                                                              sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                                              8⤵
                                                              • Launches sc.exe
                                                              PID:2380
                                                • C:\Users\Admin\AppData\Local\Temp\1001052001\Eljlre.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\1001052001\Eljlre.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5776
                                                • C:\Windows\SysWOW64\rundll32.exe
                                                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                                                  2⤵
                                                  • Blocklisted process makes network request
                                                  • Loads dropped DLL
                                                  PID:4888
                                                • C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  PID:5284
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                    3⤵
                                                      PID:4168
                                                  • C:\Users\Admin\AppData\Local\Temp\1001054001\Payload.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\1001054001\Payload.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    PID:2808
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAdABpACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGsAcABhACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVABoAGkAcwAgAGMAbwBtAHAAdQB0AGUAcgAgAGkAcwAgAG4AbwB0ACAAcwB1AHAAcABvAHIAdABlAGQALAAgAHAAbABlAGEAcwBlACAAdAByAHkAIABhAGcAYQBpAG4AIABvAG4AIABhAG4AbwB0AGgAZQByACcALAAnACcALAAnAE8ASwAnACwAJwBFAHIAcgBvAHIAJwApADwAIwB5AGMAYQAjAD4A"
                                                      3⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3996
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAbABmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAagBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAYwBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAcAB5ACMAPgA="
                                                      3⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:5076
                                                    • C:\Users\Admin\AppData\Roaming\a.exe
                                                      "C:\Users\Admin\AppData\Roaming\a.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:4856
                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                        4⤵
                                                          PID:5412
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                          4⤵
                                                            PID:7160
                                                            • C:\Windows\system32\wusa.exe
                                                              wusa /uninstall /kb:890830 /quiet /norestart
                                                              5⤵
                                                                PID:5532
                                                            • C:\Windows\system32\sc.exe
                                                              C:\Windows\system32\sc.exe delete "TDFIYZSJ"
                                                              4⤵
                                                              • Launches sc.exe
                                                              PID:6488
                                                            • C:\Windows\system32\sc.exe
                                                              C:\Windows\system32\sc.exe create "TDFIYZSJ" binpath= "C:\ProgramData\tcxbtjpidyhi\wfnmgjmvvtwt.exe" start= "auto"
                                                              4⤵
                                                              • Launches sc.exe
                                                              PID:5352
                                                            • C:\Windows\system32\sc.exe
                                                              C:\Windows\system32\sc.exe stop eventlog
                                                              4⤵
                                                              • Launches sc.exe
                                                              PID:6796
                                                            • C:\Windows\system32\sc.exe
                                                              C:\Windows\system32\sc.exe start "TDFIYZSJ"
                                                              4⤵
                                                              • Launches sc.exe
                                                              PID:5088
                                                          • C:\Users\Admin\AppData\Roaming\b.exe
                                                            "C:\Users\Admin\AppData\Roaming\b.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:5420
                                                      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                        C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                        1⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5576
                                                      • C:\Windows\system32\browser_broker.exe
                                                        C:\Windows\system32\browser_broker.exe -Embedding
                                                        1⤵
                                                          PID:1308
                                                        • C:\Windows\system32\browser_broker.exe
                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                          1⤵
                                                            PID:3156
                                                          • C:\Windows\system32\browser_broker.exe
                                                            C:\Windows\system32\browser_broker.exe -Embedding
                                                            1⤵
                                                              PID:5772
                                                            • \??\c:\windows\system32\svchost.exe
                                                              c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                              1⤵
                                                                PID:2808
                                                              • C:\Windows\system32\browser_broker.exe
                                                                C:\Windows\system32\browser_broker.exe -Embedding
                                                                1⤵
                                                                  PID:7068
                                                                • C:\Windows\system32\browser_broker.exe
                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                  1⤵
                                                                    PID:7164
                                                                  • C:\Windows\system32\browser_broker.exe
                                                                    C:\Windows\system32\browser_broker.exe -Embedding
                                                                    1⤵
                                                                      PID:6840
                                                                    • C:\Windows\system32\browser_broker.exe
                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                      1⤵
                                                                        PID:6960
                                                                      • C:\Windows\system32\browser_broker.exe
                                                                        C:\Windows\system32\browser_broker.exe -Embedding
                                                                        1⤵
                                                                          PID:6540
                                                                        • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                          1⤵
                                                                            PID:4376
                                                                          • C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe
                                                                            1⤵
                                                                              PID:6688
                                                                            • C:\ProgramData\tcxbtjpidyhi\wfnmgjmvvtwt.exe
                                                                              C:\ProgramData\tcxbtjpidyhi\wfnmgjmvvtwt.exe
                                                                              1⤵
                                                                                PID:6668
                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                  2⤵
                                                                                    PID:6648
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                    2⤵
                                                                                      PID:6476
                                                                                      • C:\Windows\system32\wusa.exe
                                                                                        wusa /uninstall /kb:890830 /quiet /norestart
                                                                                        3⤵
                                                                                          PID:984
                                                                                      • C:\Windows\system32\conhost.exe
                                                                                        C:\Windows\system32\conhost.exe
                                                                                        2⤵
                                                                                          PID:432
                                                                                        • C:\Windows\system32\conhost.exe
                                                                                          conhost.exe
                                                                                          2⤵
                                                                                            PID:5504
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D577.bat" "
                                                                                          1⤵
                                                                                            PID:7144
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                                                                              2⤵
                                                                                                PID:5280
                                                                                            • C:\Users\Admin\AppData\Local\Temp\E91F.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\E91F.exe
                                                                                              1⤵
                                                                                                PID:6672
                                                                                                • C:\Users\Admin\AppData\Local\Temp\E91F.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\E91F.exe
                                                                                                  2⤵
                                                                                                    PID:5532
                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                      icacls "C:\Users\Admin\AppData\Local\b7b8d1ec-327e-430a-944c-5b813f512e35" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                      3⤵
                                                                                                      • Modifies file permissions
                                                                                                      PID:6888
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E91F.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\E91F.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                      3⤵
                                                                                                        PID:808
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\E91F.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\E91F.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                          4⤵
                                                                                                            PID:5408
                                                                                                            • C:\Users\Admin\AppData\Local\d1d82db8-3162-4d97-ae04-df88a4838b7a\build2.exe
                                                                                                              "C:\Users\Admin\AppData\Local\d1d82db8-3162-4d97-ae04-df88a4838b7a\build2.exe"
                                                                                                              5⤵
                                                                                                                PID:3588
                                                                                                                • C:\Users\Admin\AppData\Local\d1d82db8-3162-4d97-ae04-df88a4838b7a\build2.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\d1d82db8-3162-4d97-ae04-df88a4838b7a\build2.exe"
                                                                                                                  6⤵
                                                                                                                    PID:6520
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6520 -s 2060
                                                                                                                      7⤵
                                                                                                                      • Program crash
                                                                                                                      PID:1060
                                                                                                                • C:\Users\Admin\AppData\Local\d1d82db8-3162-4d97-ae04-df88a4838b7a\build3.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\d1d82db8-3162-4d97-ae04-df88a4838b7a\build3.exe"
                                                                                                                  5⤵
                                                                                                                    PID:6780
                                                                                                                    • C:\Users\Admin\AppData\Local\d1d82db8-3162-4d97-ae04-df88a4838b7a\build3.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\d1d82db8-3162-4d97-ae04-df88a4838b7a\build3.exe"
                                                                                                                      6⤵
                                                                                                                        PID:7004
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                                                                                                          7⤵
                                                                                                                          • Creates scheduled task(s)
                                                                                                                          PID:6848
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\FC79.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\FC79.exe
                                                                                                              1⤵
                                                                                                                PID:6944
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                  2⤵
                                                                                                                    PID:6200
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6944 -s 796
                                                                                                                    2⤵
                                                                                                                    • Program crash
                                                                                                                    PID:4956
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5DB5.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\5DB5.exe
                                                                                                                  1⤵
                                                                                                                    PID:7100
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\669F.bat" "
                                                                                                                    1⤵
                                                                                                                      PID:5352
                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                        reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                                                                                                        2⤵
                                                                                                                          PID:2884
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                        1⤵
                                                                                                                          PID:6480
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe
                                                                                                                          1⤵
                                                                                                                            PID:6564
                                                                                                                          • C:\Windows\system32\browser_broker.exe
                                                                                                                            C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                            1⤵
                                                                                                                              PID:6868
                                                                                                                            • C:\Windows\system32\browser_broker.exe
                                                                                                                              C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                              1⤵
                                                                                                                                PID:6892
                                                                                                                              • C:\Windows\system32\browser_broker.exe
                                                                                                                                C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                1⤵
                                                                                                                                  PID:492
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5507.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\5507.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:4844
                                                                                                                                    • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                                                                                                                      C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                                                                                                                      2⤵
                                                                                                                                        PID:676
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:5124
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:5792
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:6376
                                                                                                                                          • C:\Windows\windefender.exe
                                                                                                                                            C:\Windows\windefender.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:3924
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6D72.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\6D72.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:6612
                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  powershell -nologo -noprofile
                                                                                                                                                  2⤵
                                                                                                                                                    PID:7132
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6D72.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6D72.exe"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2852
                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        powershell -nologo -noprofile
                                                                                                                                                        3⤵
                                                                                                                                                          PID:5672
                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                      explorer.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:808
                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
                                                                                                                                                        1⤵
                                                                                                                                                          PID:6592

                                                                                                                                                        Network

                                                                                                                                                        MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                                        Execution

                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                        1
                                                                                                                                                        T1053

                                                                                                                                                        Persistence

                                                                                                                                                        Create or Modify System Process

                                                                                                                                                        3
                                                                                                                                                        T1543

                                                                                                                                                        Windows Service

                                                                                                                                                        3
                                                                                                                                                        T1543.003

                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                        1
                                                                                                                                                        T1547

                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                        1
                                                                                                                                                        T1547.001

                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                        1
                                                                                                                                                        T1053

                                                                                                                                                        Privilege Escalation

                                                                                                                                                        Create or Modify System Process

                                                                                                                                                        3
                                                                                                                                                        T1543

                                                                                                                                                        Windows Service

                                                                                                                                                        3
                                                                                                                                                        T1543.003

                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                        1
                                                                                                                                                        T1547

                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                        1
                                                                                                                                                        T1547.001

                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                        1
                                                                                                                                                        T1053

                                                                                                                                                        Defense Evasion

                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                        2
                                                                                                                                                        T1497

                                                                                                                                                        Impair Defenses

                                                                                                                                                        2
                                                                                                                                                        T1562

                                                                                                                                                        Disable or Modify System Firewall

                                                                                                                                                        1
                                                                                                                                                        T1562.004

                                                                                                                                                        File and Directory Permissions Modification

                                                                                                                                                        1
                                                                                                                                                        T1222

                                                                                                                                                        Modify Registry

                                                                                                                                                        3
                                                                                                                                                        T1112

                                                                                                                                                        Subvert Trust Controls

                                                                                                                                                        1
                                                                                                                                                        T1553

                                                                                                                                                        Install Root Certificate

                                                                                                                                                        1
                                                                                                                                                        T1553.004

                                                                                                                                                        Credential Access

                                                                                                                                                        Unsecured Credentials

                                                                                                                                                        5
                                                                                                                                                        T1552

                                                                                                                                                        Credentials In Files

                                                                                                                                                        4
                                                                                                                                                        T1552.001

                                                                                                                                                        Credentials in Registry

                                                                                                                                                        1
                                                                                                                                                        T1552.002

                                                                                                                                                        Discovery

                                                                                                                                                        Query Registry

                                                                                                                                                        7
                                                                                                                                                        T1012

                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                        2
                                                                                                                                                        T1497

                                                                                                                                                        System Information Discovery

                                                                                                                                                        5
                                                                                                                                                        T1082

                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                        1
                                                                                                                                                        T1120

                                                                                                                                                        Remote System Discovery

                                                                                                                                                        1
                                                                                                                                                        T1018

                                                                                                                                                        Collection

                                                                                                                                                        Data from Local System

                                                                                                                                                        5
                                                                                                                                                        T1005

                                                                                                                                                        Command and Control

                                                                                                                                                        Web Service

                                                                                                                                                        1
                                                                                                                                                        T1102

                                                                                                                                                        Impact

                                                                                                                                                        Service Stop

                                                                                                                                                        1
                                                                                                                                                        T1489

                                                                                                                                                        Replay Monitor

                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                        Downloads

                                                                                                                                                        • C:\ProgramData\Are.docx
                                                                                                                                                          Filesize

                                                                                                                                                          11KB

                                                                                                                                                          MD5

                                                                                                                                                          a33e5b189842c5867f46566bdbf7a095

                                                                                                                                                          SHA1

                                                                                                                                                          e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                                                                                                                          SHA256

                                                                                                                                                          5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                                                                                                                          SHA512

                                                                                                                                                          f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                                                                                                                                        • C:\ProgramData\mozglue.dll
                                                                                                                                                          Filesize

                                                                                                                                                          593KB

                                                                                                                                                          MD5

                                                                                                                                                          c8fd9be83bc728cc04beffafc2907fe9

                                                                                                                                                          SHA1

                                                                                                                                                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                                                                                                          SHA256

                                                                                                                                                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                                                                                                          SHA512

                                                                                                                                                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BDNVZVVU\edgecompatviewlist[1].xml
                                                                                                                                                          Filesize

                                                                                                                                                          74KB

                                                                                                                                                          MD5

                                                                                                                                                          d4fc49dc14f63895d997fa4940f24378

                                                                                                                                                          SHA1

                                                                                                                                                          3efb1437a7c5e46034147cbbc8db017c69d02c31

                                                                                                                                                          SHA256

                                                                                                                                                          853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

                                                                                                                                                          SHA512

                                                                                                                                                          cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\I2OIJVV7\favicon[1].ico
                                                                                                                                                          Filesize

                                                                                                                                                          5KB

                                                                                                                                                          MD5

                                                                                                                                                          f3418a443e7d841097c714d69ec4bcb8

                                                                                                                                                          SHA1

                                                                                                                                                          49263695f6b0cdd72f45cf1b775e660fdc36c606

                                                                                                                                                          SHA256

                                                                                                                                                          6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

                                                                                                                                                          SHA512

                                                                                                                                                          82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\IC45VQUY\suggestions[1].en-US
                                                                                                                                                          Filesize

                                                                                                                                                          17KB

                                                                                                                                                          MD5

                                                                                                                                                          5a34cb996293fde2cb7a4ac89587393a

                                                                                                                                                          SHA1

                                                                                                                                                          3c96c993500690d1a77873cd62bc639b3a10653f

                                                                                                                                                          SHA256

                                                                                                                                                          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                                                                                                                                                          SHA512

                                                                                                                                                          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\YXFX014T\4Kv5U5b1o3f[1].png
                                                                                                                                                          Filesize

                                                                                                                                                          610B

                                                                                                                                                          MD5

                                                                                                                                                          a81a5e7f71ae4153e6f888f1c92e5e11

                                                                                                                                                          SHA1

                                                                                                                                                          39c3945c30abff65b372a7d8c691178ae9d9eee0

                                                                                                                                                          SHA256

                                                                                                                                                          2bc7a47889c56ad49f1b8b97385d5a4d212e79bb8a9b30df0665a165f58b273e

                                                                                                                                                          SHA512

                                                                                                                                                          1df32349b33f6a6fcb1f8b6093abd737fa0638cdd6e3fd90a7e1852bd0e40bc2633cb4e13c4824fb948d1e012e5cb9eed0b038b121404865495d4e57e123db69

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          2a789d6b366b95c47c2e68c27f863f81

                                                                                                                                                          SHA1

                                                                                                                                                          1b123bd94179f5b8746bc960691ddb9546855e05

                                                                                                                                                          SHA256

                                                                                                                                                          ba4990d90cdd27ce932e39c10e178659436aeb5a290faa47f4825da9eca6bc94

                                                                                                                                                          SHA512

                                                                                                                                                          027180aabc65ae3ca35f83161b11d289d87af854656483ac2cf703d94f695c4d5bce0fce1901278ab4cbfc985c9b9aa1f455c889913834c4b1734a365c7f8e3b

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          MD5

                                                                                                                                                          1bfe591a4fe3d91b03cdf26eaacd8f89

                                                                                                                                                          SHA1

                                                                                                                                                          719c37c320f518ac168c86723724891950911cea

                                                                                                                                                          SHA256

                                                                                                                                                          9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

                                                                                                                                                          SHA512

                                                                                                                                                          02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                                                                                                                          Filesize

                                                                                                                                                          724B

                                                                                                                                                          MD5

                                                                                                                                                          ac89a852c2aaa3d389b2d2dd312ad367

                                                                                                                                                          SHA1

                                                                                                                                                          8f421dd6493c61dbda6b839e2debb7b50a20c930

                                                                                                                                                          SHA256

                                                                                                                                                          0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

                                                                                                                                                          SHA512

                                                                                                                                                          c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_60F579AD9285D81DB40FAEE3D3BD4004
                                                                                                                                                          Filesize

                                                                                                                                                          472B

                                                                                                                                                          MD5

                                                                                                                                                          bc42cc4ae4817b4c471c397edb021714

                                                                                                                                                          SHA1

                                                                                                                                                          7a0a3e93e87cc8f75beaeae92199fcbda0fa1818

                                                                                                                                                          SHA256

                                                                                                                                                          349c99c6bd87be0c6b15f31c764bec23420c4a112d0e9b3033d0f1f058054640

                                                                                                                                                          SHA512

                                                                                                                                                          f708e131762c1d51c539eecc79f3248e1c52424e1d3a079287e7725d034dd7889da1eecaac8053f5050db0b94a4b4c4fba20984cf871ef68503a1a0d539c947a

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                                                                                                          Filesize

                                                                                                                                                          410B

                                                                                                                                                          MD5

                                                                                                                                                          5b0be634e32afd055797d01feadeefc7

                                                                                                                                                          SHA1

                                                                                                                                                          5c6f9c0597a19ff749bd67f3b23d92a73c0ea993

                                                                                                                                                          SHA256

                                                                                                                                                          075e0473a63276426c6e78efae906a2e7fdd679b67a8561407b6e79e710285ab

                                                                                                                                                          SHA512

                                                                                                                                                          da3b3857dd8be20703e3b9a5f1dc4a73a9c2df60638a65194f8ed4837a4ce34c5408fea3727ce2bde1127b73e3262320a37094b9368a3fe1d8547c1efbe683ab

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                                                                                                          Filesize

                                                                                                                                                          410B

                                                                                                                                                          MD5

                                                                                                                                                          84727529b84551513448d272d66dbd06

                                                                                                                                                          SHA1

                                                                                                                                                          04cc2464dbcc8035c74c21c3352c786be392349d

                                                                                                                                                          SHA256

                                                                                                                                                          afd91cea591f935c17770e1a457c8fcb8a827b45cc945968c6110a1f547adba4

                                                                                                                                                          SHA512

                                                                                                                                                          b1e800684ce42ac14e4f1634f61667a9649fb22a8000f77538fdcf06913aee80c6cbe8b8568767f1e15b20029b6a67cf969de3a0b7f9361974065a847d1cc038

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                                                                                                                          Filesize

                                                                                                                                                          338B

                                                                                                                                                          MD5

                                                                                                                                                          a7ccd5d03ff7c65847c9d5b4369945d6

                                                                                                                                                          SHA1

                                                                                                                                                          25cb2721ad6ec6dfee75fdff251ff71df1205149

                                                                                                                                                          SHA256

                                                                                                                                                          c595b4932b84b595c7ec8bc4dfce109773ec0e937fb943bb74ff5f95dfd561d5

                                                                                                                                                          SHA512

                                                                                                                                                          1e2958b7f993a7a0ea1e05cc82945846af3cd223c0fcbdfd6de832ae6c65ea5a1941d44575c835d3c5c9cf3fc4c596ca0fa626d41b6e95eff7d8054c4fef3a6f

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                                                                                                                          Filesize

                                                                                                                                                          392B

                                                                                                                                                          MD5

                                                                                                                                                          8e8187aa66db2f9d4e13321c04c4bf49

                                                                                                                                                          SHA1

                                                                                                                                                          ba695362a91c34d9811c598f9e5a5aae585eb8be

                                                                                                                                                          SHA256

                                                                                                                                                          b9a279ff448c6e0687753ad841bcf1d4256d6f237bba7bad7da3d478405d59ff

                                                                                                                                                          SHA512

                                                                                                                                                          d6b5e585c6487870f187b573fc6bdf24b8eedcf62ba4cf35a54ecca5ebae73db93ddcb54e006f81ded7db89886f9c01b9bbc5d9d628a4447a7d456e091a71b31

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                                                                                                                          Filesize

                                                                                                                                                          392B

                                                                                                                                                          MD5

                                                                                                                                                          5b5139ef51a855d7ff333a4b69b48d07

                                                                                                                                                          SHA1

                                                                                                                                                          83948735ae494a48d30aed0523525a8dc92d56f8

                                                                                                                                                          SHA256

                                                                                                                                                          242172227f75ae253fd3ed11b0afe186392b8f246d030df05028655bf268e4c0

                                                                                                                                                          SHA512

                                                                                                                                                          bf33b5b43639ec0a2205e2031fa96377777498c86ffb92d5fdcef946b6dbf7bd16041a5a354bae6726042a3373338e1be86731a28e86df7a9b2104975c2c09ad

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_60F579AD9285D81DB40FAEE3D3BD4004
                                                                                                                                                          Filesize

                                                                                                                                                          406B

                                                                                                                                                          MD5

                                                                                                                                                          d734c1237b5e026b13707ea8013b68f5

                                                                                                                                                          SHA1

                                                                                                                                                          2f13e2d872f9cb9cec94f8109b65b8ceb109105b

                                                                                                                                                          SHA256

                                                                                                                                                          0a8401bbd3d7e2ecfc1acef37564c50df826b53ac9fce2ec209ed404fa9f65f3

                                                                                                                                                          SHA512

                                                                                                                                                          6f3305473cc8472a57098b662d76cf8643a3944e3b58b862e29620e2d8bcd09488ecc3f62077730801586c8d5b52af7e91407924b51e59254015f895617e145d

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                                                                                                                          Filesize

                                                                                                                                                          1.8MB

                                                                                                                                                          MD5

                                                                                                                                                          1c05d457318827e3fb0ac2d7c55679e7

                                                                                                                                                          SHA1

                                                                                                                                                          196962c56d7b1fc7a9418a11610999aceb48b5fa

                                                                                                                                                          SHA256

                                                                                                                                                          6cbc335731e0a3100d3c9a835a335a5f4cd2869e19431141ba3d47b8443ae678

                                                                                                                                                          SHA512

                                                                                                                                                          e9df1bf4a09fd22ebed1a478c97b58724360c052c70568fab01c94af0fb185bc8474b17af9d1d8a5ebf26d170a5c34e161875cf012c3fab9a5ab7d5f71b39d3c

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000042001\e8741b9d71.exe
                                                                                                                                                          Filesize

                                                                                                                                                          3.1MB

                                                                                                                                                          MD5

                                                                                                                                                          339f3f4f39d82660a784f3fb070220f1

                                                                                                                                                          SHA1

                                                                                                                                                          a03957dadfbc4d434510278b58f4d7e655effce5

                                                                                                                                                          SHA256

                                                                                                                                                          93b6b07774d558791bc34c872f8d67123b26fb070f7612278e37e934c71c9abe

                                                                                                                                                          SHA512

                                                                                                                                                          06b181700ff678ab659cbab3486b9c28f30e3c333274541549b11e08e45d1a9a8389efb247a9dd52ffd327a7d7d08380f1730e0df5bfc9750f44d4674cb3f165

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
                                                                                                                                                          Filesize

                                                                                                                                                          894KB

                                                                                                                                                          MD5

                                                                                                                                                          2f8912af892c160c1c24c9f38a60c1ab

                                                                                                                                                          SHA1

                                                                                                                                                          d2deae508e262444a8f15c29ebcc7ebbe08a3fdb

                                                                                                                                                          SHA256

                                                                                                                                                          59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308

                                                                                                                                                          SHA512

                                                                                                                                                          0395383bde98d358b0a7f2224f903dff026ce0c6d90feb49ac0e6993ef692143b0eb25da84d9cdc9e7b373a7b75a6dbaef14746eda1bff165d59f07ca51a16bb

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
                                                                                                                                                          Filesize

                                                                                                                                                          1.8MB

                                                                                                                                                          MD5

                                                                                                                                                          ec93a5bb219ec14537cf26f14afc58bf

                                                                                                                                                          SHA1

                                                                                                                                                          80c81a9e8b475da3fcd11ac6f723bfc310bf6d0a

                                                                                                                                                          SHA256

                                                                                                                                                          a4d284833cc9722c38fad22c113080efe8fa25806d0d5fd30a3489e99502f141

                                                                                                                                                          SHA512

                                                                                                                                                          ec8ba22c46a524ddffb2d15ff09427c718381f25acf275d31651a883141b83f20c50e277255213a9b52ca1cbe2dc663f2b896d67ca911b2e74888e5024a7132e

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000180001\ISetup8.exe
                                                                                                                                                          Filesize

                                                                                                                                                          403KB

                                                                                                                                                          MD5

                                                                                                                                                          f1fd85fdcd7dfbf501165bfa4da026f5

                                                                                                                                                          SHA1

                                                                                                                                                          1c94b732063412ec148c290ed567bd61cde0c698

                                                                                                                                                          SHA256

                                                                                                                                                          bc053d271bffc10ecdf0e64ec8b54e823d73b3a8848a71d90fb36868a6301bb4

                                                                                                                                                          SHA512

                                                                                                                                                          1c8681452b340c9618e53609e25ff6a5e8b3bbda93d8152f9474c5e698bc771dfa0b957d8c4e2e27c728017a7a3978b170f7332e27750304f14d47835d43ff9e

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000181001\toolspub1.exe
                                                                                                                                                          Filesize

                                                                                                                                                          259KB

                                                                                                                                                          MD5

                                                                                                                                                          eb37bf9e55ec9794c37a1cd473b70272

                                                                                                                                                          SHA1

                                                                                                                                                          58de7f346f3dcb915a1f1a5a73a13fae77233c7c

                                                                                                                                                          SHA256

                                                                                                                                                          f4ddc32a5112ba367c194ff4619caed816b1f5941772a50b81f4ddc59db84270

                                                                                                                                                          SHA512

                                                                                                                                                          d37a023d4f6712a0a2aa850d4490cb5e6da56075360e9f6d184adde4645e0afd87ed33e23ae7c9fd51f89948956595724108d466915266adc007c0fa587ffb31

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                                                                                                                          Filesize

                                                                                                                                                          4.1MB

                                                                                                                                                          MD5

                                                                                                                                                          3b9d8a696db601cdf45a126968a86458

                                                                                                                                                          SHA1

                                                                                                                                                          c175a387b99031d36c37d9e242f79baa914f0b11

                                                                                                                                                          SHA256

                                                                                                                                                          d32c8d7ecba3591ee8081435d5c2301fcf3db24e296ff2e53f78a89fef057227

                                                                                                                                                          SHA512

                                                                                                                                                          df21476deac6d6573748b578f5892fbffda3ff2075aa18078e8a4a21d937237e8eeab34dc4c1ff5085e8641056e720d4d46aaa5476934c09dc292e5acc1ce96e

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
                                                                                                                                                          Filesize

                                                                                                                                                          1.7MB

                                                                                                                                                          MD5

                                                                                                                                                          85a15f080b09acace350ab30460c8996

                                                                                                                                                          SHA1

                                                                                                                                                          3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

                                                                                                                                                          SHA256

                                                                                                                                                          3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

                                                                                                                                                          SHA512

                                                                                                                                                          ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe
                                                                                                                                                          Filesize

                                                                                                                                                          1.8MB

                                                                                                                                                          MD5

                                                                                                                                                          e3f2565e66bef7c990748a5f99b706c4

                                                                                                                                                          SHA1

                                                                                                                                                          52808d09a2b8c7b4fe54e3f0634ad74663003a37

                                                                                                                                                          SHA256

                                                                                                                                                          3bce752207b2f203bf9d90528279efdde5cf758d4c0ff3c28f446c758b98981e

                                                                                                                                                          SHA512

                                                                                                                                                          c03ba03ffaf5d8ade527be7a9a8efec7e28d702cf6d2cefefb0be396e867033efa80501b69975405df9980cc1e2ca6612bd1ae28ee017c80b5a74f9d8e931979

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
                                                                                                                                                          Filesize

                                                                                                                                                          301KB

                                                                                                                                                          MD5

                                                                                                                                                          832eb4dc3ed8ceb9a1735bd0c7acaf1b

                                                                                                                                                          SHA1

                                                                                                                                                          b622a406927fbb8f6cd5081bd4455fb831948fca

                                                                                                                                                          SHA256

                                                                                                                                                          2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7

                                                                                                                                                          SHA512

                                                                                                                                                          3ab8b25732a7152608be101a3daf0d55833c554ab968be8b3b79a49e1831f3ee0eeeb9586a3334fa387b1f160fd15e98a80dcfece559c9c257b44ef962874894

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
                                                                                                                                                          Filesize

                                                                                                                                                          499KB

                                                                                                                                                          MD5

                                                                                                                                                          83d0b41c7a3a0d29a268b49a313c5de5

                                                                                                                                                          SHA1

                                                                                                                                                          46f3251c771b67b40b1f3268caef8046174909a5

                                                                                                                                                          SHA256

                                                                                                                                                          09cc3364d5e1c15228822926bc65ce290c487dc3b7c0345bf265538110fa9cc9

                                                                                                                                                          SHA512

                                                                                                                                                          705ecc7c421338e37ed0d58c2d9fad03fb3565db422a0c9d895e75a399bf5f2a70cfe3ffdc860ffe010d4d1a213e0a844aeadb89ea8e0c830a2fc8c03b7669b5

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1001050001\NewB.exe
                                                                                                                                                          Filesize

                                                                                                                                                          418KB

                                                                                                                                                          MD5

                                                                                                                                                          0099a99f5ffb3c3ae78af0084136fab3

                                                                                                                                                          SHA1

                                                                                                                                                          0205a065728a9ec1133e8a372b1e3864df776e8c

                                                                                                                                                          SHA256

                                                                                                                                                          919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                                                                                                                                          SHA512

                                                                                                                                                          5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1001051001\Umr.exe
                                                                                                                                                          Filesize

                                                                                                                                                          296B

                                                                                                                                                          MD5

                                                                                                                                                          f2f4183ae342466a505cb5b8dc850ce2

                                                                                                                                                          SHA1

                                                                                                                                                          3f6ddc6152d0190108953e410ec62e8abcdc51d1

                                                                                                                                                          SHA256

                                                                                                                                                          fc56488690aec272d2853fb59f6678391f19fc67707ed0e31688d337d5159b7d

                                                                                                                                                          SHA512

                                                                                                                                                          aa5cfb6e787255918880e1e71703c2280e0012ed08d5eaf5a91f8d43d984a8f30107b852bfc74eb1b6004032e4c91cb985629fea3a0a3579ac64564f8c542c73

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1001052001\Eljlre.exe
                                                                                                                                                          Filesize

                                                                                                                                                          2.8MB

                                                                                                                                                          MD5

                                                                                                                                                          1e1152424d7721a51a154a725fe2465e

                                                                                                                                                          SHA1

                                                                                                                                                          62bc3d11e915e1dbd3cc3ef5a11afec755c995d9

                                                                                                                                                          SHA256

                                                                                                                                                          674cf1a8997ec6ac5b29b8d7eb6a5fb63ce5aaf4b19ff1ec7749b0225c49906c

                                                                                                                                                          SHA512

                                                                                                                                                          752e7912d30a2f006ef79600b7412db61644630471ec44bab1e5b2565ef62ccb490ea69159420bb7626248cc8113fe07c09fa51f5c630646b179d880e18b7c02

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
                                                                                                                                                          Filesize

                                                                                                                                                          464KB

                                                                                                                                                          MD5

                                                                                                                                                          c084d6f6ba40534fbfc5a64b21ef99ab

                                                                                                                                                          SHA1

                                                                                                                                                          0b4a17da83c0a8abbc8fab321931d5447b32b720

                                                                                                                                                          SHA256

                                                                                                                                                          afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624

                                                                                                                                                          SHA512

                                                                                                                                                          a5384a2f7029cf946fde44e1ff30775754ce525ca5a6fdac14184872b6e684cb6e585053cb86d32f82cbd3db48eb195ba3a642d8ee3774be579fccd993938ca1

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1001054001\Payload.exe
                                                                                                                                                          Filesize

                                                                                                                                                          2.6MB

                                                                                                                                                          MD5

                                                                                                                                                          55e393da1714013720ddf266c7906f43

                                                                                                                                                          SHA1

                                                                                                                                                          91a636913604184c010c2d9e0b331a804a2c0ab4

                                                                                                                                                          SHA256

                                                                                                                                                          6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957

                                                                                                                                                          SHA512

                                                                                                                                                          40a61e1d461717e45eff3be6b22561ac39c2ef1af39b46f7d149fe823d14a06bb99605a78e794d6447ece43ce6b4854192e47ad993ed4a2e78479bc7e155fe8a

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\669F.bat
                                                                                                                                                          Filesize

                                                                                                                                                          77B

                                                                                                                                                          MD5

                                                                                                                                                          55cc761bf3429324e5a0095cab002113

                                                                                                                                                          SHA1

                                                                                                                                                          2cc1ef4542a4e92d4158ab3978425d517fafd16d

                                                                                                                                                          SHA256

                                                                                                                                                          d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                                                                                                                                                          SHA512

                                                                                                                                                          33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\TmpB8CC.tmp
                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                          SHA1

                                                                                                                                                          bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                          SHA256

                                                                                                                                                          f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                          SHA512

                                                                                                                                                          6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ozmz5wfg.3ie.ps1
                                                                                                                                                          Filesize

                                                                                                                                                          1B

                                                                                                                                                          MD5

                                                                                                                                                          c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                                          SHA1

                                                                                                                                                          356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                                          SHA256

                                                                                                                                                          6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                                          SHA512

                                                                                                                                                          4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          a0afc6ce143fca9beb7d9c1af775f4bb

                                                                                                                                                          SHA1

                                                                                                                                                          1faf85358dd80a6e9a044a3b2efbf250ff8411a7

                                                                                                                                                          SHA256

                                                                                                                                                          28e188792982c0abb75e65533a3c4293f78ef7f85dc4de26d217d09b4736f76f

                                                                                                                                                          SHA512

                                                                                                                                                          7bb37a0a99c325559aa2ca48424839729af119bc8dfd542b486d1f3c032079a2faf3d202d4fd5de71d953b5d9fa7f72999b07a2f0a2a3a216a0ee9bd65a7dd0f

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                                                                                                                          Filesize

                                                                                                                                                          3KB

                                                                                                                                                          MD5

                                                                                                                                                          f853e2f933f2a0c3d5107f74b560d568

                                                                                                                                                          SHA1

                                                                                                                                                          8f3b8daefeb119420cae165c05d4aa80327c2db7

                                                                                                                                                          SHA256

                                                                                                                                                          0aced75c1a6ec4ef0bab53866385a450f6324baf7dd7ed2a01951d98940d6fcb

                                                                                                                                                          SHA512

                                                                                                                                                          11ddd045daa4573605632e4cbdbb4be7662039f600153d0d721762650db4dbbb902b35c89b93be35bec2d9d92bde8b1b449a5fef26fa39b80c6c4bdf5e1ac42a

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp7DF6.tmp
                                                                                                                                                          Filesize

                                                                                                                                                          92KB

                                                                                                                                                          MD5

                                                                                                                                                          d0ff39c7b0a5041a7e5f4d2ac846949f

                                                                                                                                                          SHA1

                                                                                                                                                          e4c7e6d4833859e6bfbd0a84ef755c1f874b5536

                                                                                                                                                          SHA256

                                                                                                                                                          d358fef996de827b7bb797d16e78cfa542ecc8c32810e3564a7c07d7a4a96886

                                                                                                                                                          SHA512

                                                                                                                                                          96a5887cfecd38b71f313f888e193790ecaa1d38a84b7676eba15b4caf52fa3d89cf82024ba499f4c6b593120c80d79daea3ac47ad5a109d20b7bcacaf4f0161

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmp7E22.tmp
                                                                                                                                                          Filesize

                                                                                                                                                          96KB

                                                                                                                                                          MD5

                                                                                                                                                          d367ddfda80fdcf578726bc3b0bc3e3c

                                                                                                                                                          SHA1

                                                                                                                                                          23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

                                                                                                                                                          SHA256

                                                                                                                                                          0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

                                                                                                                                                          SHA512

                                                                                                                                                          40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpDB1B.tmp
                                                                                                                                                          Filesize

                                                                                                                                                          46KB

                                                                                                                                                          MD5

                                                                                                                                                          02d2c46697e3714e49f46b680b9a6b83

                                                                                                                                                          SHA1

                                                                                                                                                          84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                                                                                                                          SHA256

                                                                                                                                                          522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                                                                                                                          SHA512

                                                                                                                                                          60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u4os.0.exe
                                                                                                                                                          Filesize

                                                                                                                                                          259KB

                                                                                                                                                          MD5

                                                                                                                                                          4524e1a1e2725e159d68b3bca2c1b296

                                                                                                                                                          SHA1

                                                                                                                                                          0e3b226d0ebd227b911c5fc25d6a28478ed0a957

                                                                                                                                                          SHA256

                                                                                                                                                          12a5bac24e4e354bfc93a989c398df11ac5ec63c9d9834e0a9062bd8857cdda7

                                                                                                                                                          SHA512

                                                                                                                                                          870e0e4e86593a3f060643b043d41f2aa6108af8075f19c0ba6c9d276a28df5c6f6e02a6cd088eb88382af35a41bcd626ea5add747494d468158abb7e610f3ca

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\u4os.1.exe
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                          MD5

                                                                                                                                                          397926927bca55be4a77839b1c44de6e

                                                                                                                                                          SHA1

                                                                                                                                                          e10f3434ef3021c399dbba047832f02b3c898dbd

                                                                                                                                                          SHA256

                                                                                                                                                          4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                                                                                                                                          SHA512

                                                                                                                                                          cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                                                                                                                                                          Filesize

                                                                                                                                                          109KB

                                                                                                                                                          MD5

                                                                                                                                                          2afdbe3b99a4736083066a13e4b5d11a

                                                                                                                                                          SHA1

                                                                                                                                                          4d4856cf02b3123ac16e63d4a448cdbcb1633546

                                                                                                                                                          SHA256

                                                                                                                                                          8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

                                                                                                                                                          SHA512

                                                                                                                                                          d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
                                                                                                                                                          Filesize

                                                                                                                                                          1.2MB

                                                                                                                                                          MD5

                                                                                                                                                          92fbdfccf6a63acef2743631d16652a7

                                                                                                                                                          SHA1

                                                                                                                                                          971968b1378dd89d59d7f84bf92f16fc68664506

                                                                                                                                                          SHA256

                                                                                                                                                          b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

                                                                                                                                                          SHA512

                                                                                                                                                          b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                          Filesize

                                                                                                                                                          299KB

                                                                                                                                                          MD5

                                                                                                                                                          41b883a061c95e9b9cb17d4ca50de770

                                                                                                                                                          SHA1

                                                                                                                                                          1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

                                                                                                                                                          SHA256

                                                                                                                                                          fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

                                                                                                                                                          SHA512

                                                                                                                                                          cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                                                                                                                                          Filesize

                                                                                                                                                          109KB

                                                                                                                                                          MD5

                                                                                                                                                          726cd06231883a159ec1ce28dd538699

                                                                                                                                                          SHA1

                                                                                                                                                          404897e6a133d255ad5a9c26ac6414d7134285a2

                                                                                                                                                          SHA256

                                                                                                                                                          12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                                                                                                                                                          SHA512

                                                                                                                                                          9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                                                                                                                                                          Filesize

                                                                                                                                                          541KB

                                                                                                                                                          MD5

                                                                                                                                                          1fc4b9014855e9238a361046cfbf6d66

                                                                                                                                                          SHA1

                                                                                                                                                          c17f18c8246026c9979ab595392a14fe65cc5e9f

                                                                                                                                                          SHA256

                                                                                                                                                          f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50

                                                                                                                                                          SHA512

                                                                                                                                                          2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12

                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                                                                                                                                                          Filesize

                                                                                                                                                          304KB

                                                                                                                                                          MD5

                                                                                                                                                          cc90e3326d7b20a33f8037b9aab238e4

                                                                                                                                                          SHA1

                                                                                                                                                          236d173a6ac462d85de4e866439634db3b9eeba3

                                                                                                                                                          SHA256

                                                                                                                                                          bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7

                                                                                                                                                          SHA512

                                                                                                                                                          b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521

                                                                                                                                                        • C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          3abbf9db417cd6edb1a36f5a61c57196

                                                                                                                                                          SHA1

                                                                                                                                                          bf46773f871a49ddfcb80c4e5799ef4e547f507b

                                                                                                                                                          SHA256

                                                                                                                                                          e2472265d3e7c55a96c0bedfb055662c557e0b53912d9a8f10c9676da7452f98

                                                                                                                                                          SHA512

                                                                                                                                                          aef8798e1adc420904e22002d6c2146504c2c7e91600a73bbe5d1e65c2fa7051ef5db90adc3df38cad150357a9bd1a90e99f24a63787b606fc3e5011d5dea915

                                                                                                                                                        • memory/216-5-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/216-6-0x0000000004E00000-0x0000000004E01000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/216-385-0x000001BC50620000-0x000001BC50622000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/216-383-0x000001BC50600000-0x000001BC50602000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/216-2-0x00000000012A0000-0x0000000001744000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                        • memory/216-246-0x000001BC4F000000-0x000001BC4F100000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          1024KB

                                                                                                                                                        • memory/216-271-0x000001BC4F400000-0x000001BC4F500000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          1024KB

                                                                                                                                                        • memory/216-0-0x00000000012A0000-0x0000000001744000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                        • memory/216-4-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/216-9-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/216-8-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/216-19-0x00000000012A0000-0x0000000001744000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                        • memory/216-7-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/216-395-0x000001BC506B0000-0x000001BC506B2000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/216-3-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/216-381-0x000001BC505F0000-0x000001BC505F2000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/216-393-0x000001BC506A0000-0x000001BC506A2000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/216-391-0x000001BC50680000-0x000001BC50682000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/216-389-0x000001BC50660000-0x000001BC50662000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/216-387-0x000001BC50640000-0x000001BC50642000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/216-1-0x0000000077C94000-0x0000000077C95000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/216-12-0x0000000004E10000-0x0000000004E11000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/216-11-0x0000000004E20000-0x0000000004E21000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/216-379-0x000001BC50530000-0x000001BC50532000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/216-377-0x000001BC50510000-0x000001BC50512000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/216-375-0x000001BC4F1F0000-0x000001BC4F1F2000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/216-369-0x000001BC4EA30000-0x000001BC4EA32000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/1388-166-0x000001C67EBC0000-0x000001C67EBC2000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/1388-168-0x000001C67EBE0000-0x000001C67EBE2000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/1388-164-0x000001C67EBA0000-0x000001C67EBA2000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/1772-36-0x0000000004C10000-0x0000000004C11000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/1772-33-0x0000000000AA0000-0x0000000000F44000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                        • memory/1772-35-0x0000000004C00000-0x0000000004C01000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/1772-41-0x0000000000AA0000-0x0000000000F44000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                        • memory/1772-39-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/1772-38-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/1772-37-0x0000000004C30000-0x0000000004C31000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/1772-40-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/1772-42-0x0000000000AA0000-0x0000000000F44000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                        • memory/2652-491-0x0000000000CB0000-0x0000000001066000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          3.7MB

                                                                                                                                                        • memory/2652-398-0x0000000000CB0000-0x0000000001066000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          3.7MB

                                                                                                                                                        • memory/2652-59-0x0000000000CB0000-0x0000000001066000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          3.7MB

                                                                                                                                                        • memory/2652-58-0x0000000000CB0000-0x0000000001066000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          3.7MB

                                                                                                                                                        • memory/2888-44-0x0000000000AA0000-0x0000000000F44000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                        • memory/2888-45-0x0000000000AA0000-0x0000000000F44000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                        • memory/2888-20-0x0000000000AA0000-0x0000000000F44000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                        • memory/2888-26-0x0000000004D90000-0x0000000004D91000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/2888-397-0x0000000000AA0000-0x0000000000F44000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                        • memory/2888-28-0x0000000004D40000-0x0000000004D41000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/2888-43-0x0000000000AA0000-0x0000000000F44000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                        • memory/2888-34-0x0000000000AA0000-0x0000000000F44000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                        • memory/2888-31-0x0000000000AA0000-0x0000000000F44000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                        • memory/2888-29-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/2888-30-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/2888-22-0x0000000000AA0000-0x0000000000F44000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                        • memory/2888-23-0x0000000004D60000-0x0000000004D61000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/2888-27-0x0000000004D30000-0x0000000004D31000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/2888-25-0x0000000004D50000-0x0000000004D51000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/2888-24-0x0000000004D70000-0x0000000004D71000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/3416-360-0x000001F8DCCB0000-0x000001F8DCCB1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/3416-359-0x000001F8DC7F0000-0x000001F8DC7F1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/3416-108-0x000001F8D51F0000-0x000001F8D51F2000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/3416-89-0x000001F8D61E0000-0x000001F8D61F0000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          64KB

                                                                                                                                                        • memory/3416-73-0x000001F8D5F20000-0x000001F8D5F30000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          64KB

                                                                                                                                                        • memory/5068-289-0x000001751FF00000-0x000001751FF02000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/5068-294-0x000001751FF10000-0x000001751FF12000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/5068-280-0x000001751FED0000-0x000001751FED2000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/5548-586-0x0000000004B90000-0x0000000004B91000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5548-572-0x0000000001020000-0x00000000014D8000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.7MB

                                                                                                                                                        • memory/5548-573-0x0000000004B30000-0x0000000004B31000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5548-574-0x0000000004B40000-0x0000000004B41000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5548-587-0x0000000004B80000-0x0000000004B81000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5548-576-0x0000000004B60000-0x0000000004B61000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5548-569-0x0000000001020000-0x00000000014D8000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.7MB

                                                                                                                                                        • memory/5548-575-0x0000000004B20000-0x0000000004B21000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5548-578-0x0000000001010000-0x0000000001011000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5548-577-0x0000000001000000-0x0000000001001000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5576-579-0x0000000000AA0000-0x0000000000F44000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                        • memory/5576-585-0x0000000004A60000-0x0000000004A61000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5576-571-0x0000000000AA0000-0x0000000000F44000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.6MB

                                                                                                                                                        • memory/5576-580-0x0000000004A80000-0x0000000004A81000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5576-584-0x0000000004A50000-0x0000000004A51000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5576-583-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5576-582-0x0000000004A70000-0x0000000004A71000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5576-581-0x0000000004A90000-0x0000000004A91000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5844-483-0x0000000000900000-0x0000000000DB8000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.7MB

                                                                                                                                                        • memory/5844-484-0x0000000004980000-0x0000000004981000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5844-485-0x0000000004990000-0x0000000004991000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5844-486-0x00000000049B0000-0x00000000049B1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5844-487-0x0000000004950000-0x0000000004951000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5844-482-0x0000000000900000-0x0000000000DB8000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.7MB

                                                                                                                                                        • memory/5844-493-0x00000000049D0000-0x00000000049D1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5844-488-0x0000000004970000-0x0000000004971000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5844-489-0x0000000004960000-0x0000000004961000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5844-492-0x00000000049E0000-0x00000000049E1000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/5844-498-0x0000000000900000-0x0000000000DB8000-memory.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          4.7MB