Malware Analysis Report

2024-10-23 19:45

Sample ID 240424-wcm5taeb8z
Target https://samples.vx-underground.org/Samples/Bazaar%20Collection/Downloadable%20Releases/Bazaar.2020.08.7z
Tags
emotet nanocore ostap remcos epoch1 epoch2 epoch3 july-logs banker downloader evasion keylogger persistence rat spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://samples.vx-underground.org/Samples/Bazaar%20Collection/Downloadable%20Releases/Bazaar.2020.08.7z was found to be: Known bad.

Malicious Activity Summary

emotet nanocore ostap remcos epoch1 epoch2 epoch3 july-logs banker downloader evasion keylogger persistence rat spyware stealer trojan upx

NanoCore

Emotet

Remcos

ostap

Ostap JavaScript downloader

Emotet payload

Blocklisted process makes network request

Executes dropped EXE

Checks computer location settings

UPX packed file

Adds Run key to start application

Looks up external IP address via web service

Checks whether UAC is enabled

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Enumerates system info in registry

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious behavior: MapViewOfSection

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-24 17:46

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-24 17:46

Reported

2024-04-24 18:07

Platform

win10v2004-20240412-en

Max time kernel

1200s

Max time network

1203s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://samples.vx-underground.org/Samples/Bazaar%20Collection/Downloadable%20Releases/Bazaar.2020.08.7z

Signatures

Emotet

trojan banker emotet

NanoCore

keylogger trojan stealer spyware nanocore

Ostap JavaScript downloader

Description Indicator Process Target
N/A N/A N/A N/A

Remcos

rat remcos

ostap

downloader ostap

Emotet payload

trojan banker
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\Backdoor.Win32.Remcos.ptx-10bd3e2c0e8caf01756c71de42d8656875a64daae61ec1b8175a84fb064c94e4.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\Backdoor.Win32.Remcos.ptx-10bd3e2c0e8caf01756c71de42d8656875a64daae61ec1b8175a84fb064c94e4.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Hesv.gen-0fe7af2933781cea89408cc70b9563727d7d4e96dc9a7d18d8d92460823e0a9f.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Agent.myucdp-0c64aa3ccc9b4f7482dbd5f3291a82bea3607c1290fad0a91b18d7101387d185.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Remcos.ptx-10bd3e2c0e8caf01756c71de42d8656875a64daae61ec1b8175a84fb064c94e4.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0a7db31b23de98f23e6397f1bf2117cf17705b398f23daf40d14a3ae955acab3.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.gen-0333c87c90ad38e8b603e64b9355ff846b72c8698a20c7110e086f19a5a74c6b.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0df724506fe4e48553b6a88790348bf5234756c7761d2d52e83743654c7e1fd1.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-115cb7215cf91e5fc653e9cb0264e6abc380176b2b5baeed6d9bacd1638134ba.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Exploit.Win32.ShellCode.vho-138c60f8df9c59cf59cbdfbf5004ceda539b0de2cd70207b79833805594a9746.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-0fb9d2a859110a1ec0d6c6280c1f7b633637b4cab38cd4cdcc9ded2727dfb35d.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Hesv.gen-0fe7af2933781cea89408cc70b9563727d7d4e96dc9a7d18d8d92460823e0a9f.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Crypt.gen-0b0537b9f976c4a49f1105bc03d252c0cac7a99b9abdb1a020d2966b6a0b1285.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Spy.Win32.Noon.gen-ceffcce2144e6f7b1724f53f9812b05c6066efb4cf70ba1ff178a0f50d021d30.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-086c83fc511485a76ff068c50bff11cbe26daa6c9f6e76e6bc15718a0a216d15.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-01b9c4d76d4170d9d8393c117eeba7347af3a6b355bcdf4fd765ab5f1fec6261.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-0d79086771a3ec611cccecf0fb92b6b1c7cbc23afdc3fadb05b2940d40e8a1ec.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-PSW.MSIL.Agensla.gen-13af67261cdde6647fc4c1669ced247f69a2e03b08e62dfea53a3af3d4a867da.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-039deec86f2d44a9d3f27b0a2d9aed879b03f359b382ef04d9474d55f20a6553.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Spy.Win32.Noon.gen-ceffcce2144e6f7b1724f53f9812b05c6066efb4cf70ba1ff178a0f50d021d30.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Agent.myucdp-0c64aa3ccc9b4f7482dbd5f3291a82bea3607c1290fad0a91b18d7101387d185.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.gen-0333c87c90ad38e8b603e64b9355ff846b72c8698a20c7110e086f19a5a74c6b.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-0fb9d2a859110a1ec0d6c6280c1f7b633637b4cab38cd4cdcc9ded2727dfb35d.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0df724506fe4e48553b6a88790348bf5234756c7761d2d52e83743654c7e1fd1.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-115cb7215cf91e5fc653e9cb0264e6abc380176b2b5baeed6d9bacd1638134ba.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Remcos.ptx-10bd3e2c0e8caf01756c71de42d8656875a64daae61ec1b8175a84fb064c94e4.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0a7db31b23de98f23e6397f1bf2117cf17705b398f23daf40d14a3ae955acab3.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Exploit.Win32.ShellCode.vho-138c60f8df9c59cf59cbdfbf5004ceda539b0de2cd70207b79833805594a9746.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Hesv.gen-0fe7af2933781cea89408cc70b9563727d7d4e96dc9a7d18d8d92460823e0a9f.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Hesv.gen-0fe7af2933781cea89408cc70b9563727d7d4e96dc9a7d18d8d92460823e0a9f.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Crypt.gen-0b0537b9f976c4a49f1105bc03d252c0cac7a99b9abdb1a020d2966b6a0b1285.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\Desktop\Backdoor.Win32.Agent.myucdp-0c64aa3ccc9b4f7482dbd5f3291a82bea3607c1290fad0a91b18d7101387d185.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\59909268\\TLPMGD~1.PIF C:\\Users\\Admin\\AppData\\Roaming\\59909268\\nlncgw.ath" C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\Desktop\Backdoor.Win32.Agent.myucdp-0c64aa3ccc9b4f7482dbd5f3291a82bea3607c1290fad0a91b18d7101387d185.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\59909268\\TLPMGD~1.PIF C:\\Users\\Admin\\AppData\\Roaming\\59909268\\nlncgw.ath" C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\Desktop\HEUR-Trojan-Spy.Win32.Noon.gen-ceffcce2144e6f7b1724f53f9812b05c6066efb4cf70ba1ff178a0f50d021d30.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133584544540248545" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A
N/A N/A C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Spy.Win32.Noon.gen-ceffcce2144e6f7b1724f53f9812b05c6066efb4cf70ba1ff178a0f50d021d30.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0a7db31b23de98f23e6397f1bf2117cf17705b398f23daf40d14a3ae955acab3.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0a7db31b23de98f23e6397f1bf2117cf17705b398f23daf40d14a3ae955acab3.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.gen-0333c87c90ad38e8b603e64b9355ff846b72c8698a20c7110e086f19a5a74c6b.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.gen-0333c87c90ad38e8b603e64b9355ff846b72c8698a20c7110e086f19a5a74c6b.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0df724506fe4e48553b6a88790348bf5234756c7761d2d52e83743654c7e1fd1.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0df724506fe4e48553b6a88790348bf5234756c7761d2d52e83743654c7e1fd1.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-115cb7215cf91e5fc653e9cb0264e6abc380176b2b5baeed6d9bacd1638134ba.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-115cb7215cf91e5fc653e9cb0264e6abc380176b2b5baeed6d9bacd1638134ba.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-0fb9d2a859110a1ec0d6c6280c1f7b633637b4cab38cd4cdcc9ded2727dfb35d.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-0fb9d2a859110a1ec0d6c6280c1f7b633637b4cab38cd4cdcc9ded2727dfb35d.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-0d79086771a3ec611cccecf0fb92b6b1c7cbc23afdc3fadb05b2940d40e8a1ec.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-0d79086771a3ec611cccecf0fb92b6b1c7cbc23afdc3fadb05b2940d40e8a1ec.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-039deec86f2d44a9d3f27b0a2d9aed879b03f359b382ef04d9474d55f20a6553.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-039deec86f2d44a9d3f27b0a2d9aed879b03f359b382ef04d9474d55f20a6553.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe N/A
N/A N/A C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-115cb7215cf91e5fc653e9cb0264e6abc380176b2b5baeed6d9bacd1638134ba.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-0fb9d2a859110a1ec0d6c6280c1f7b633637b4cab38cd4cdcc9ded2727dfb35d.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-0fb9d2a859110a1ec0d6c6280c1f7b633637b4cab38cd4cdcc9ded2727dfb35d.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.gen-0333c87c90ad38e8b603e64b9355ff846b72c8698a20c7110e086f19a5a74c6b.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.gen-0333c87c90ad38e8b603e64b9355ff846b72c8698a20c7110e086f19a5a74c6b.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0df724506fe4e48553b6a88790348bf5234756c7761d2d52e83743654c7e1fd1.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0df724506fe4e48553b6a88790348bf5234756c7761d2d52e83743654c7e1fd1.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-115cb7215cf91e5fc653e9cb0264e6abc380176b2b5baeed6d9bacd1638134ba.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0a7db31b23de98f23e6397f1bf2117cf17705b398f23daf40d14a3ae955acab3.exe N/A
N/A N/A C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0a7db31b23de98f23e6397f1bf2117cf17705b398f23daf40d14a3ae955acab3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2756 wrote to memory of 4468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 4468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 3680 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1792 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1792 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2756 wrote to memory of 1916 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://samples.vx-underground.org/Samples/Bazaar%20Collection/Downloadable%20Releases/Bazaar.2020.08.7z

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa1baab58,0x7ffaa1baab68,0x7ffaa1baab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1860,i,6113089179558922974,3803936812785210354,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1860,i,6113089179558922974,3803936812785210354,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2276 --field-trial-handle=1860,i,6113089179558922974,3803936812785210354,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1860,i,6113089179558922974,3803936812785210354,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1860,i,6113089179558922974,3803936812785210354,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1860,i,6113089179558922974,3803936812785210354,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 --field-trial-handle=1860,i,6113089179558922974,3803936812785210354,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1860,i,6113089179558922974,3803936812785210354,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4476 --field-trial-handle=1860,i,6113089179558922974,3803936812785210354,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 --field-trial-handle=1860,i,6113089179558922974,3803936812785210354,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1860,i,6113089179558922974,3803936812785210354,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=992 --field-trial-handle=1860,i,6113089179558922974,3803936812785210354,131072 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Bazaar.2020.08.7z"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5068 --field-trial-handle=1860,i,6113089179558922974,3803936812785210354,131072 /prefetch:2

C:\Users\Admin\Desktop\Backdoor.Win32.Agent.myucdp-0c64aa3ccc9b4f7482dbd5f3291a82bea3607c1290fad0a91b18d7101387d185.exe

"C:\Users\Admin\Desktop\Backdoor.Win32.Agent.myucdp-0c64aa3ccc9b4f7482dbd5f3291a82bea3607c1290fad0a91b18d7101387d185.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c type dex.txt & del /f "plo.png" & waiting.jse & exit

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\waiting.jse"

C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe

"C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe"

C:\Users\Admin\Desktop\Backdoor.Win32.Remcos.ptx-10bd3e2c0e8caf01756c71de42d8656875a64daae61ec1b8175a84fb064c94e4.exe

"C:\Users\Admin\Desktop\Backdoor.Win32.Remcos.ptx-10bd3e2c0e8caf01756c71de42d8656875a64daae61ec1b8175a84fb064c94e4.exe"

C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif

"C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif" nlncgw.ath

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"

C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0a7db31b23de98f23e6397f1bf2117cf17705b398f23daf40d14a3ae955acab3.exe

"C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0a7db31b23de98f23e6397f1bf2117cf17705b398f23daf40d14a3ae955acab3.exe"

C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.gen-0333c87c90ad38e8b603e64b9355ff846b72c8698a20c7110e086f19a5a74c6b.exe

"C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.gen-0333c87c90ad38e8b603e64b9355ff846b72c8698a20c7110e086f19a5a74c6b.exe"

C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0df724506fe4e48553b6a88790348bf5234756c7761d2d52e83743654c7e1fd1.exe

"C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0df724506fe4e48553b6a88790348bf5234756c7761d2d52e83743654c7e1fd1.exe"

C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-115cb7215cf91e5fc653e9cb0264e6abc380176b2b5baeed6d9bacd1638134ba.exe

"C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-115cb7215cf91e5fc653e9cb0264e6abc380176b2b5baeed6d9bacd1638134ba.exe"

C:\Users\Admin\Desktop\HEUR-Exploit.Win32.ShellCode.vho-138c60f8df9c59cf59cbdfbf5004ceda539b0de2cd70207b79833805594a9746.exe

"C:\Users\Admin\Desktop\HEUR-Exploit.Win32.ShellCode.vho-138c60f8df9c59cf59cbdfbf5004ceda539b0de2cd70207b79833805594a9746.exe"

C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-0fb9d2a859110a1ec0d6c6280c1f7b633637b4cab38cd4cdcc9ded2727dfb35d.exe

"C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-0fb9d2a859110a1ec0d6c6280c1f7b633637b4cab38cd4cdcc9ded2727dfb35d.exe"

C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Hesv.gen-0fe7af2933781cea89408cc70b9563727d7d4e96dc9a7d18d8d92460823e0a9f.exe

"C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Hesv.gen-0fe7af2933781cea89408cc70b9563727d7d4e96dc9a7d18d8d92460823e0a9f.exe"

C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Crypt.gen-0b0537b9f976c4a49f1105bc03d252c0cac7a99b9abdb1a020d2966b6a0b1285.exe

"C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Crypt.gen-0b0537b9f976c4a49f1105bc03d252c0cac7a99b9abdb1a020d2966b6a0b1285.exe"

C:\Users\Admin\Desktop\HEUR-Trojan-Spy.Win32.Noon.gen-ceffcce2144e6f7b1724f53f9812b05c6066efb4cf70ba1ff178a0f50d021d30.exe

"C:\Users\Admin\Desktop\HEUR-Trojan-Spy.Win32.Noon.gen-ceffcce2144e6f7b1724f53f9812b05c6066efb4cf70ba1ff178a0f50d021d30.exe"

C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-086c83fc511485a76ff068c50bff11cbe26daa6c9f6e76e6bc15718a0a216d15.exe

"C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-086c83fc511485a76ff068c50bff11cbe26daa6c9f6e76e6bc15718a0a216d15.exe"

C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-039deec86f2d44a9d3f27b0a2d9aed879b03f359b382ef04d9474d55f20a6553.exe

"C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-039deec86f2d44a9d3f27b0a2d9aed879b03f359b382ef04d9474d55f20a6553.exe"

C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-01b9c4d76d4170d9d8393c117eeba7347af3a6b355bcdf4fd765ab5f1fec6261.exe

"C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-01b9c4d76d4170d9d8393c117eeba7347af3a6b355bcdf4fd765ab5f1fec6261.exe"

C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-0d79086771a3ec611cccecf0fb92b6b1c7cbc23afdc3fadb05b2940d40e8a1ec.exe

"C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-0d79086771a3ec611cccecf0fb92b6b1c7cbc23afdc3fadb05b2940d40e8a1ec.exe"

C:\Users\Admin\Desktop\HEUR-Trojan-PSW.MSIL.Agensla.gen-13af67261cdde6647fc4c1669ced247f69a2e03b08e62dfea53a3af3d4a867da.exe

"C:\Users\Admin\Desktop\HEUR-Trojan-PSW.MSIL.Agensla.gen-13af67261cdde6647fc4c1669ced247f69a2e03b08e62dfea53a3af3d4a867da.exe"

C:\Users\Admin\Desktop\HEUR-Trojan-Spy.Win32.Noon.gen-ceffcce2144e6f7b1724f53f9812b05c6066efb4cf70ba1ff178a0f50d021d30.exe

"C:\Users\Admin\Desktop\HEUR-Trojan-Spy.Win32.Noon.gen-ceffcce2144e6f7b1724f53f9812b05c6066efb4cf70ba1ff178a0f50d021d30.exe"

C:\Users\Admin\Desktop\Backdoor.Win32.Agent.myucdp-0c64aa3ccc9b4f7482dbd5f3291a82bea3607c1290fad0a91b18d7101387d185.exe

"C:\Users\Admin\Desktop\Backdoor.Win32.Agent.myucdp-0c64aa3ccc9b4f7482dbd5f3291a82bea3607c1290fad0a91b18d7101387d185.exe"

C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.gen-0333c87c90ad38e8b603e64b9355ff846b72c8698a20c7110e086f19a5a74c6b.exe

"C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.gen-0333c87c90ad38e8b603e64b9355ff846b72c8698a20c7110e086f19a5a74c6b.exe"

C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-0fb9d2a859110a1ec0d6c6280c1f7b633637b4cab38cd4cdcc9ded2727dfb35d.exe

"C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-0fb9d2a859110a1ec0d6c6280c1f7b633637b4cab38cd4cdcc9ded2727dfb35d.exe"

C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe

"C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe"

C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0df724506fe4e48553b6a88790348bf5234756c7761d2d52e83743654c7e1fd1.exe

"C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0df724506fe4e48553b6a88790348bf5234756c7761d2d52e83743654c7e1fd1.exe"

C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-115cb7215cf91e5fc653e9cb0264e6abc380176b2b5baeed6d9bacd1638134ba.exe

"C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-115cb7215cf91e5fc653e9cb0264e6abc380176b2b5baeed6d9bacd1638134ba.exe"

C:\Users\Admin\Desktop\Backdoor.Win32.Remcos.ptx-10bd3e2c0e8caf01756c71de42d8656875a64daae61ec1b8175a84fb064c94e4.exe

"C:\Users\Admin\Desktop\Backdoor.Win32.Remcos.ptx-10bd3e2c0e8caf01756c71de42d8656875a64daae61ec1b8175a84fb064c94e4.exe"

C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0a7db31b23de98f23e6397f1bf2117cf17705b398f23daf40d14a3ae955acab3.exe

"C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0a7db31b23de98f23e6397f1bf2117cf17705b398f23daf40d14a3ae955acab3.exe"

C:\Users\Admin\Desktop\HEUR-Exploit.Win32.ShellCode.vho-138c60f8df9c59cf59cbdfbf5004ceda539b0de2cd70207b79833805594a9746.exe

"C:\Users\Admin\Desktop\HEUR-Exploit.Win32.ShellCode.vho-138c60f8df9c59cf59cbdfbf5004ceda539b0de2cd70207b79833805594a9746.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c type dex.txt & del /f "plo.png" & waiting.jse & exit

C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif

"C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif" nlncgw.ath

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\waiting.jse"

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"

C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Hesv.gen-0fe7af2933781cea89408cc70b9563727d7d4e96dc9a7d18d8d92460823e0a9f.exe

"{path}"

C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Hesv.gen-0fe7af2933781cea89408cc70b9563727d7d4e96dc9a7d18d8d92460823e0a9f.exe

"{path}"

C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Crypt.gen-0b0537b9f976c4a49f1105bc03d252c0cac7a99b9abdb1a020d2966b6a0b1285.exe

"{path}"

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 samples.vx-underground.org udp
US 104.18.7.192:443 samples.vx-underground.org tcp
US 8.8.8.8:53 192.7.18.104.in-addr.arpa udp
US 8.8.8.8:53 202.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 198.32.209.4.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 154.173.246.72.in-addr.arpa udp
US 8.8.8.8:53 48.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 156.33.209.4.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 252.15.104.51.in-addr.arpa udp
RU 176.96.238.128:443 tcp
US 107.185.211.16:80 tcp
US 96.8.113.4:8080 tcp
RU 176.96.238.128:443 tcp
JP 153.126.210.205:7080 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 8.8.8.8:53 alhabib4rec.ddns.net udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 8.8.8.8:53 118.135.218.216.in-addr.arpa udp
US 8.8.8.8:53 alhabib4rec.duckdns.org udp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 26.69.169.192.in-addr.arpa udp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 47.146.117.214:80 tcp
RU 176.96.238.128:443 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 104.131.44.150:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
RU 176.96.238.128:443 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
ZA 169.239.182.217:8080 tcp
GB 95.179.229.244:8080 tcp
US 8.8.8.8:53 alhabib4rec.duckdns.org udp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 209.182.216.177:443 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 174.100.27.229:80 tcp
RU 176.96.238.128:443 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 209.141.54.221:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 200.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 209.126.6.222:8080 tcp
US 162.249.220.190:80 tcp
US 8.8.8.8:53 alhabib4rec.duckdns.org udp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 200.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
FR 5.196.74.210:8080 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
RU 176.96.238.128:443 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
GB 5.153.250.14:8080 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 174.100.27.229:80 tcp
FR 85.25.207.108:8080 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 72.12.127.184:443 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 192.241.146.84:8080 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 209.126.6.222:8080 tcp
US 178.128.14.92:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
RU 176.96.238.128:443 tcp
US 104.131.11.150:443 tcp
ID 112.78.142.170:80 tcp
TR 95.9.180.128:80 tcp
US 8.8.8.8:53 alhabib4rec.duckdns.org udp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
GB 5.153.250.14:8080 tcp
EC 181.113.229.139:443 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
AR 200.55.243.138:8080 tcp
US 178.128.14.92:8080 tcp
PL 77.55.211.77:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 192.241.146.84:8080 tcp
VN 118.70.15.19:8080 tcp
RU 176.96.238.128:443 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 143.95.101.72:8080 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
DE 178.238.232.46:443 tcp
DE 116.203.32.252:8080 tcp
TR 85.105.140.135:443 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
TR 95.9.180.128:80 tcp
US 8.8.8.8:53 alhabib4rec.duckdns.org udp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
AU 139.99.157.213:8080 tcp
NL 185.142.236.163:443 tcp
US 142.105.151.124:443 tcp
US 45.33.77.42:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
PL 77.55.211.77:8080 tcp
RU 176.96.238.128:443 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
AR 201.235.10.215:80 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 192.210.217.94:8080 tcp
CZ 81.2.235.111:8080 tcp
DE 77.90.136.129:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
TR 85.105.140.135:443 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
CO 181.137.229.1:80 tcp
US 192.241.220.183:8080 tcp
CA 74.120.55.163:80 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
LT 94.176.234.118:443 tcp
RU 176.96.238.128:443 tcp
US 45.33.77.42:8080 tcp
US 8.8.8.8:53 alhabib4rec.duckdns.org udp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
ZA 105.209.235.113:8080 tcp
NL 5.79.70.250:8080 tcp
DE 167.86.90.214:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
CL 190.163.31.26:80 tcp
DE 87.106.139.101:8080 tcp
DE 77.90.136.129:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
PK 182.187.139.200:8080 tcp
US 107.161.30.122:8080 tcp
RU 176.96.238.128:443 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
HN 190.6.193.152:8080 tcp
US 98.13.75.196:80 tcp
KZ 188.0.135.237:80 tcp
NL 37.139.21.175:8080 tcp
LT 94.176.234.118:443 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
JP 157.7.164.178:8081 tcp
US 8.8.8.8:53 alhabib4rec.duckdns.org udp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
HN 190.181.235.46:80 190.181.235.46 tcp
US 8.8.8.8:53 46.235.181.190.in-addr.arpa udp
FR 91.121.54.71:8080 tcp
AR 201.213.177.139:80 tcp
LV 81.198.69.61:80 tcp
MX 189.212.199.126:443 tcp
CL 190.163.31.26:80 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
DE 87.106.231.60:8080 tcp
RU 176.96.238.128:443 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 209.236.123.42:8080 tcp
GE 31.146.61.34:80 tcp
TH 103.86.49.11:8080 tcp
RS 188.2.217.94:80 tcp
HN 190.6.193.152:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
ID 203.153.216.189:7080 tcp
BD 202.5.47.71:80 202.5.47.71 tcp
US 8.8.8.8:53 71.47.5.202.in-addr.arpa udp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
DE 172.105.78.244:8080 tcp
GB 89.32.150.160:8080 tcp
BD 202.5.47.71:80 202.5.47.71 tcp
TH 114.109.179.60:80 tcp
HN 190.181.235.46:80 190.181.235.46 tcp
AZ 81.17.93.134:80 tcp
LV 81.198.69.61:80 tcp
US 8.8.8.8:53 alhabib4rec.duckdns.org udp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
EC 181.211.11.242:80 tcp
BR 177.94.227.143:80 tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
RU 176.96.238.128:443 tcp
GB 212.71.237.140:8080 tcp
FR 83.169.21.32:7080 tcp
US 192.163.221.191:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
RS 188.2.217.94:80 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
FR 37.187.72.193:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 173.94.215.84:80 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
FR 51.255.165.160:8080 tcp
FR 137.74.106.111:7080 tcp
US 97.104.107.190:80 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
TH 114.109.179.60:80 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
ZA 41.60.200.34:80 tcp
PY 181.126.54.234:80 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
RU 176.96.238.128:443 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
OM 188.135.15.49:80 tcp
ES 212.231.60.98:80 tcp
AR 201.235.10.215:80 tcp
FR 83.169.21.32:7080 tcp
US 8.8.8.8:53 alhabib4rec.duckdns.org udp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
BR 170.81.48.2:80 tcp
AU 139.130.242.43:80 tcp
GB 217.199.160.224:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
BR 189.2.177.210:443 tcp
BO 181.114.114.203:80 tcp
FR 137.74.106.111:7080 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
BR 177.74.228.34:80 tcp
AR 181.230.116.163:80 tcp
US 198.57.203.63:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
RU 176.96.238.128:443 tcp
BR 45.161.242.102:80 tcp
GB 178.79.163.131:8080 tcp
FR 51.38.201.19:7080 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
ES 212.231.60.98:80 tcp
SE 109.74.5.95:8080 tcp
CO 190.147.137.153:443 tcp
BR 177.144.130.105:443 tcp
BR 170.81.48.2:80 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 72.167.223.217:8080 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
GB 46.32.229.152:8080 tcp
US 8.8.8.8:53 alhabib4rec.duckdns.org udp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
KR 121.124.124.40:7080 tcp
RU 176.96.238.128:443 tcp
US 73.116.193.136:80 tcp
US 66.61.94.36:80 tcp
BR 177.74.228.34:80 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
BA 77.238.212.227:80 tcp
BR 177.144.130.105:443 tcp
GB 178.79.163.131:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
JP 114.146.222.200:80 tcp
DE 195.201.56.70:8080 tcp
MX 187.162.248.237:80 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
EC 186.70.127.199:8090 tcp
CO 190.147.137.153:443 tcp
PT 188.251.213.180:443 tcp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
IN 157.245.99.39:8080 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
TR 81.214.253.80:443 tcp
RU 80.249.176.206:80 tcp
RU 176.96.238.128:443 tcp
US 45.33.77.42:8080 tcp
US 73.116.193.136:80 tcp
HU 91.83.93.103:443 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 76.27.179.47:80 tcp
BR 168.0.97.6:80 tcp
US 12.162.84.2:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
DE 87.106.46.107:8080 tcp
MX 187.162.248.237:80 tcp
VN 118.70.15.19:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
ZA 197.83.232.19:80 tcp
FR 62.138.26.28:8080 tcp
RU 37.46.129.215:8080 tcp
MY 219.92.13.25:80 tcp
RU 176.96.238.128:443 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
RU 80.249.176.206:80 tcp
SG 172.104.169.32:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
DE 195.201.56.70:8080 tcp
US 24.43.99.75:80 tcp
JP 60.125.114.64:443 tcp
CZ 46.28.111.142:7080 tcp
US 8.8.8.8:53 alhabib4rec.duckdns.org udp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 12.162.84.2:8080 tcp
MX 187.162.248.237:80 tcp
BO 181.114.114.203:80 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
DE 185.94.252.12:80 tcp
RU 176.96.238.128:443 tcp
DE 172.105.78.244:8080 tcp
IT 93.51.50.171:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
MY 219.92.13.25:80 tcp
CL 190.163.31.26:80 tcp
BR 177.37.81.212:443 tcp
NL 185.142.236.163:443 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
RS 24.135.198.218:80 tcp
JP 157.147.76.151:80 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
CZ 46.28.111.142:7080 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
TR 95.9.180.128:80 tcp
BD 175.29.183.2:80 tcp
SG 172.96.190.154:8080 tcp
DE 185.94.252.12:80 tcp
RU 176.96.238.128:443 tcp
US 8.8.8.8:53 alhabib4rec.duckdns.org udp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
GB 217.199.160.224:7080 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
AE 83.110.223.58:443 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 71.197.211.156:80 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
HU 91.83.93.103:443 tcp
BR 177.32.8.85:80 tcp
RS 24.135.198.218:80 tcp
US 70.32.115.157:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
FR 46.105.131.79:8080 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
UA 91.219.169.180:80 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 107.161.30.122:8080 tcp
FR 178.33.167.120:8080 tcp
GB 217.199.160.224:7080 tcp
RU 176.96.238.128:443 tcp
UA 91.219.169.180:80 tcp
KR 119.198.40.179:80 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
BR 170.81.48.2:80 tcp
US 8.8.8.8:53 alhabib4rec.duckdns.org udp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
PT 188.251.213.180:443 tcp
BD 175.29.183.2:80 tcp
US 70.32.115.157:8080 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
CL 186.103.141.250:443 tcp
LT 79.98.24.39:8080 tcp
LT 94.176.234.118:443 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
UA 176.111.60.55:8080 tcp
RU 77.74.78.80:443 77.74.78.80 tcp
BY 86.57.216.23:80 tcp
UA 91.219.169.180:80 tcp
US 8.8.8.8:53 80.78.74.77.in-addr.arpa udp
US 70.32.84.74:8080 tcp
CL 190.164.75.175:80 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
RU 176.96.238.128:443 tcp
AU 111.67.12.221:8080 tcp
US 8.8.4.4:53 acokoye85.hopto.org udp
CL 190.160.53.126:80 tcp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 acokoye85.hopto.org udp
SE 185.86.148.68:443 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
CL 186.103.141.250:443 tcp
US 71.197.211.156:80 tcp
US 174.45.13.118:80 tcp
US 98.13.75.196:80 tcp
US 47.146.117.214:80 tcp
US 8.8.8.8:53 acokoye85.hopto.org udp
US 8.8.4.4:53 acokoye85.hopto.org udp
US 8.8.8.8:53 acokoye85.hopto.org udp
SG 172.104.169.32:8080 tcp
BY 86.57.216.23:80 tcp
US 8.8.8.8:53 acokoye85.hopto.org udp
KR 183.101.175.193:80 tcp
US 8.8.4.4:53 acokoye85.hopto.org udp
US 8.8.8.8:53 alhabib4rec.duckdns.org udp
RU 176.96.238.128:443 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 174.100.27.229:80 tcp
US 107.185.211.16:80 tcp
US 98.13.75.196:80 tcp
US 174.100.27.229:80 tcp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
ID 112.78.142.170:80 tcp
US 162.249.220.190:80 tcp
CO 190.147.137.153:443 tcp
US 8.8.8.8:53 acokoye85.hopto.org udp
HK 185.140.53.15:7600 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 198.57.203.63:8080 tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 70.32.84.74:8080 tcp
DE 87.118.70.45:8080 tcp
US 45.55.36.51:443 45.55.36.51 tcp
FR 91.121.54.71:8080 tcp
DE 62.108.54.22:8080 tcp
US 8.8.8.8:53 51.36.55.45.in-addr.arpa udp
CO 181.129.96.162:8080 tcp
HK 185.140.53.15:7600 tcp
US 45.55.36.51:443 tcp
GB 46.32.229.152:8080 tcp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 104.236.246.93:8080 tcp
US 192.169.69.26:2404 alhabib4rec.duckdns.org tcp
US 8.8.8.8:53 177.101.63.23.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.13.205:80 api.ipify.org tcp
US 8.8.8.8:53 alhabib4rec.freeddns.org udp
US 216.218.135.118:2404 alhabib4rec.ddns.net tcp
US 96.8.113.4:8080 tcp
US 209.126.6.222:8080 tcp
FR 91.121.54.71:8080 tcp
US 209.126.6.222:8080 tcp
US 178.128.14.92:8080 tcp
HU 91.83.93.99:7080 tcp
FR 85.25.207.108:8080 tcp
US 8.8.8.8:53 205.13.26.104.in-addr.arpa udp
HK 185.140.53.15:7600 tcp
US 104.26.13.205:80 tcp

Files

\??\pipe\crashpad_2756_PWWVCGJPFLTPXMFG

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 eefdd65412871c23ed8ca35dcb3016f2
SHA1 7bda4adeb41316931c528c4894fa9bde3b33407f
SHA256 849d89f838eb69a91b61d4930f974256b9a6787a6dab65f161fa2129d47f2209
SHA512 45261f952f158f084c95cfeb3f8946c8ff2e15c90d514fa8621ab15831067c1597bc1f0aaef0a16543a6005f5fb6b489d41df344d5c2aef5f907292ee349dd65

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 b4956a5e31b03ceedce0b529445412ea
SHA1 5df6b2b1eed7a226fab97159c04a50794ca4c7df
SHA256 d1d04b81962985671b49d8c4ed37d35eba381dbded1f565bf534ebcc9e8941f5
SHA512 fe7cb9940614f5c52e7f2fbea9c3f73a1e180b7fbae9cc438a08499b1c8f477b086f75a7aea080099cb6ba7bccd4b813d7d2e6c926045b6e35f96d7309ce8268

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 816b8beeeaaa283ac3c7b04bcdba4dc2
SHA1 bcd12f4ed8f654dc439749d4a9be0a695bbea1d9
SHA256 637ea44bf6cff4ab5224f8594658511e276e2a4c7e6f9e809a20cc3ff87c13b6
SHA512 21ba8e2065fa956ea04f634c936b2bb27f6f0ef652ad342511bbcaaa7dd0421563948e68b5f500bf925bd884aa1b819332cf5ea2600282cf18dcd72627f0cbb1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 5f20c19b57eb4f78214e7f0595b3337a
SHA1 a6062a22caff5b6f77d77337dd457249b3c36ae5
SHA256 3f476bd38dfd5445092ef028e3f054f342ce05030abe6b951696c0458a86172a
SHA512 3603b0380cf1cc001d1829f055166acb1151a1d14a2870d9cbc0ef25d70a177e0650688e558d9c1fbe043faf5d379fc6289e7ef981a06efe1915c2107ba5fe9c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57d35d.TMP

MD5 4e3fd45f60f2aed1e2a83c2664020f60
SHA1 6f60b77b058633ea7481a29e40f83303f3416d8b
SHA256 faf600bdd0b9a5d576a807a04af1dd8c9f559b6cdcece1b01b1903c4b78ea8eb
SHA512 3a65fc143615f19b44c2fe7817fdda783bc38d7edb65396382118d92fc581b399ca448ef6263a9b7b2201d8e72f76b9ec1fa78b7658d809cfefd9fb218929bd9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 36cb847dbf4ecdcfd8c80ace943ea2c7
SHA1 5c90f1cda747ced13135941fd94429586ca73400
SHA256 3f677f7b62a7db5e9a624370537a293e9271c6359d85f24fdd3303e75ed0c0b0
SHA512 9fe4b57657e9af3cdc02a6e5d9963af66d66818e75e9e7da2b5ad1cfbecce58e03e3cca100d7c851f816c28154c7ffece5f0beaf3872255cf03357edd4db6c7e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 992353bfe9b52caf020b7c1362b8ade4
SHA1 e7337f90e93cc4bd06805c4a8c4da8399a62fbaa
SHA256 fe582747e415f4b3fd1849f577e81a3c4175a668b05b5a8611ae74158913a15c
SHA512 f18be3a0713a179e69f0cf2bfd0dd681ca79bf47de0056e129061d9a360c8a35413a70adae1d6aaff14f76d7654584deb9dd02c81539f0c1e9475ea4f61a581f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 5a31603bb7a1194f993cf38c91564e7c
SHA1 2e68b8e4d3522d0e1afac022b91e845fe1750464
SHA256 2447082f404ae7aea567363505a8dfaec79524222d2a4e9587b0adeebc87af1a
SHA512 d40d0939fe8731a9bfdf50f73ffddf789619dbc57c4ca7292da5f287b82f27bc637ef524f662948d310eb5aa962869048260e583c082c55f1b49f5f67531f323

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 065f82974b031f028074d54cc07ad19e
SHA1 9c4d98a78291c5b9e816e80b379ec05e500ab52a
SHA256 51eabe375d2ac0a065c81b3c7a4090d09ef41687bca03d93801cae092702b824
SHA512 e5acbedba5ee637535d7dabd905d6630151dfaf0611bc93b44f2e38650f721fde2504e8b255ece6dd35314fd3d20c44526f83a89fe679a6aac025f41df107a5f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 2da7af1f8e2f1ee99a6c0f428bbb85d4
SHA1 3f3ed456bc5c50c949ce2f636537f695c303e69f
SHA256 6a44bc8609239be02f56db2d213e35d84622dda1d91444658d08926a1fe6a6a9
SHA512 9e14cd5fd3fca1ae4e788312d0317750b373f00d459219343ebe8ca8c35c0e48d97ef2b0d672f72bdb0925fa5654b8ba2e3de109d72908cb8953f4e1404ef752

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 3d74e05cca5c7cff45465fea4c00a9bc
SHA1 b4388e2f1319b076c6a8d870bc6b4c083411336a
SHA256 d370635b4f246c9ba43e5de6ed7922fc18f1f54a0a8df7fb740e4bec1f94060a
SHA512 1e77e86e3bd7e7ca99fdbc0da78aa3d78dc53763e1a7be042a5c95cffee06f74fa5fa7d7a872549db9e101fdc64c7712295fa0308ba3c402acf645357ced9451

C:\Users\Admin\Downloads\Bazaar.2020.08.7z

MD5 5e12a8bf7cbca3552e5daac5f1e5417d
SHA1 cce3f004a00f217311f2f4be672e5b8982728746
SHA256 a1fcadae568ec102701c91bcb862c004947fc8afc32ee0d2f6dd19e5146e3e48
SHA512 fe17a05de7055a8f24f0ee2a37473cee2da7000024361ec20bc445ecdeeecd7299f895cb8667b163ab3279345c6832eb71fd0f5472873728343bbfb7f827a7a2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

MD5 449eef695ad3eee4648ffb29b1d73c9c
SHA1 75a81de1dd526b3039334090903c125c6566fe49
SHA256 c4dfa1926e0fd10818b88ba06616f89292e41cd32861d1b5bb8ade09d8829ab5
SHA512 bf2ac92cc74c7926d70039845fa73336bb8fd72e99a30803bf7fd7a6a0f27b194d400ac381eeb5c1a1704396946b4ed57225fe4290b1d7e578e6da3f9eedd579

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 a46cc19225458bfd671df84f00b8438a
SHA1 ad9148fbb7f8d131a85635fbf76e7fab1d1f008c
SHA256 1abfd572eac9d5cd07eebf457faf95d8afce4e711749f3c4a8eb659312000ab2
SHA512 3ba2ff1e6fdd8733ce430223ed206a03b500f5544adbc209b88243fbe58c2f2ed75e87a08d59eca65dfb597a792bce14756025bf37a12a64b22d206540a34a2d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 72134a6a7ccaa447a014af258b26dbf9
SHA1 e39ebdb5d33bb28433d7e8d47e8d3f1c68e6e498
SHA256 93648cf34f4dd80b793bd6732af9a59673a2bd0b0783b88840f84edfb7b049c1
SHA512 a7919dd7a6b26998cff4527977aabc92ab6a39b16577d90bc14f75ebcd1ab2f551cbdf0b54c63084797b8d065b8db362d27e4bae53eed0364cd295d366863634

C:\Users\Admin\Desktop\Backdoor.Win32.Agent.myucdp-0c64aa3ccc9b4f7482dbd5f3291a82bea3607c1290fad0a91b18d7101387d185.exe

MD5 61dfe6e47ef6060b961f7106a421c3f4
SHA1 1e01068a3cca4b1ec159be4b7777adbeb8e7bc14
SHA256 0c64aa3ccc9b4f7482dbd5f3291a82bea3607c1290fad0a91b18d7101387d185
SHA512 c7daee1a5b0da2780873ee13003f5c489bc562073e5707c62e7c2f024640469b9a95b2365ec83d5fddbdfe0dc88edab635e33e12816a403249b24e27218d8c71

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dex.txt

MD5 339ce91fcc14d02545d0bfc905793e97
SHA1 4af7080d52aa23b0eb75204715b4bdfdeb551490
SHA256 f6bde58aca61f8d9b5790d58737713be415bb3ae0b6766265f252eee2122b1a1
SHA512 3fc93c8457b8630d39bbaf111869276e9b5115e7f8d8f1ab95ebc6fd4ad294d7914db58a9440d623ab7a53c935a23e90a3f22215007bf5dd89144924e28d49ca

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\plo.PNG

MD5 ea90a771e0242e2aaf76280f2b0b2ff5
SHA1 84d9a48bc777db82a31dd14f9f07fe95a654ff4c
SHA256 e9f305700f634be9e8d7641dc54e0ad0ff5453c1d211e5a11dbc41e7f1a01289
SHA512 9f16fce1de42f6fe003c0bdf9b6b22fda92723023b425b695150997831f8074788c9022f11e37f34d04c31f95b9cac8f6d27d0350a1668ee63955e7fdbf286c4

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\waiting.jse

MD5 40e8c77f38d2be287e12ade334a2b831
SHA1 f534c5072f63acd888e1dc0e287f973387cdd320
SHA256 ee1484721f7727d6f402cffa4e7dd5bed09ee7b2a17b769b4f551c47857c9f50
SHA512 4b921c215f304e65b591ee0673a42726c9ba04d881c62ee8f4f8746289f0dfd2ca171e04be0523c3715a72f6f1232b7a022b3ed264b867c708003640d2225fc7

C:\Users\Admin\Desktop\Backdoor.Win32.Emotet.btbj-08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d.exe

MD5 cbb990906124bc3584c5558c001a9681
SHA1 cb94eb825cafbdb49a768d21fd95882c2a9f2fcd
SHA256 08a157264299a1adf8536b89652a9656be846985f821b15e15176049d48e777d
SHA512 db592d4e84ee103a3ede98dc881f2497e4c9725b6152b0f9b3d9f0d8bf605a37bca21c116348e557d171c1c08cef605e27c72aaab81a169c4a1dafe8142a31c5

memory/1616-259-0x0000000000720000-0x000000000072C000-memory.dmp

memory/1616-263-0x0000000000710000-0x0000000000719000-memory.dmp

memory/1616-264-0x0000000000720000-0x000000000072C000-memory.dmp

C:\Users\Admin\Desktop\Backdoor.Win32.Mokes.akgz-134b8bdca42b72cacb0cbc5acd33d543bd193f82b7443dfdd74fa0a0a86c5806.exe

MD5 6d14ce295c944e61dedb767d2c8f601b
SHA1 7372aa6eae38c29867b0d25179590ca38a075a6b
SHA256 134b8bdca42b72cacb0cbc5acd33d543bd193f82b7443dfdd74fa0a0a86c5806
SHA512 fb32a83934ace946eb7db8e3905513841097cb3db234e865b50bae682529dd434e8ac09c97686ec5729bea04d4b8815d0d336c161ec343618a7f3d3535d140c4

C:\Users\Admin\Desktop\Backdoor.Win32.Remcos.ptx-10bd3e2c0e8caf01756c71de42d8656875a64daae61ec1b8175a84fb064c94e4.exe

MD5 42f2b26bcd9ad840f1445785726449f1
SHA1 d5861e7a6217dc6f1f5c2309bd617b5f0ca371dc
SHA256 10bd3e2c0e8caf01756c71de42d8656875a64daae61ec1b8175a84fb064c94e4
SHA512 b57e1cd214c91159449aac8304033aa104001fd4c53e0dae659e883cd9aa1709cf6a42b0cd175ccc1e4f432b131eeea4fe4b46ea14a73c40ad2de15c0116edb7

C:\Users\Admin\AppData\Roaming\59909268\tlpmgdweq.pif

MD5 9fc46b6036032a8d8a89e3567a3dcec3
SHA1 42dcd68b4a35686b000a18efb4c2b2ae07d5cc94
SHA256 0e96860caa7e17fdcacac170b59189eb500761d5a80954d92e7f7b0ecb6b9534
SHA512 45c10d083b1abc6cfcb54cd5d1a5343c1f8b25ac89c3800b173634073204a94cc7bbbe52caa2c465af739a438cc0df7daf2a62defc5220b2b72e507dbae0be3d

C:\Users\Admin\AppData\Roaming\59909268\nlncgw.ath

MD5 914ef797d945f434361d12e0fe005782
SHA1 5caac973d566840580e960a64423c551b660becf
SHA256 74e401773c87cc279e1e55192408043e2d61e78e8cdbfa625f3b755f6ffa372b
SHA512 318a31cb84c3dc58193f4895aef2227410345993fe5d89424676e67d7cdbdcabd186736599ea922008c29cbd992e3c2b1486eded6481edfb80d070ff96022ee1

C:\Users\Admin\AppData\Roaming\59909268\tnblkocel.bin

MD5 1db5057da63cb0c1e451f2afec2993df
SHA1 104400efd20a63fd4f19816c7de44b13e8dcea64
SHA256 b8f7e2ab29a5037ea36d11387cf6260d71a23721f03275ccb863e8ca2bee9d6a
SHA512 b44d6ffdeb0063d2016840f9538d5b818cacc167cf22cffc0878ff857d251096a31155bf53c00637f3f34ab627cab54f27b23858d3ed10503df935b8e169c1dd

memory/4544-350-0x0000000001100000-0x0000000001620000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

memory/4544-354-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-356-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-357-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-359-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-360-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-361-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-363-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-367-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-368-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-369-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-370-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-373-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-374-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-375-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-376-0x0000000001100000-0x0000000001620000-memory.dmp

C:\Users\Admin\Desktop\HEUR-Backdoor.Java.Agent.gen-065886e5f23caa5fbd11b2c35ee0261bb1c629f32acf4fe3e4f2bc4675b33312.exe

MD5 52afe99d28cef5dbdeeca99137bf1a71
SHA1 0d62165305e0630e13b4de6631475e8cbbca4029
SHA256 065886e5f23caa5fbd11b2c35ee0261bb1c629f32acf4fe3e4f2bc4675b33312
SHA512 c178d4857b2995bde2bd8a43d919321254e4e425171fe55424ab194b66ce95694f4eadf5f61b7867f871eddbef7c1dcf71a9540ae239829e99b368ec811095e4

memory/4544-382-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-383-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-384-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-385-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-388-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-389-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-390-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-393-0x0000000001100000-0x0000000001620000-memory.dmp

C:\Users\Admin\Desktop\HEUR-Backdoor.MSIL.Androm.gen-07a092c1770ce812ae35ae8f1b5a6d1e4ff4bdc8bdc9fc47ee04a863ada28c4c.exe

MD5 9124c84fc995a81fb2bb300d54b894af
SHA1 31cffe81e16ffe806701a1905389a5f34e48003c
SHA256 07a092c1770ce812ae35ae8f1b5a6d1e4ff4bdc8bdc9fc47ee04a863ada28c4c
SHA512 63dcf1155813b915b466b8de686336915d62bac218b4a60aa7d2e0b8b7415f44a14943ba6659178dcc96efff350aed0e51510be9de6d7c11d5889ee952868eb1

memory/4544-398-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-399-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-400-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-401-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-403-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-404-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-407-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-408-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-411-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-412-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-413-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-416-0x0000000001100000-0x0000000001620000-memory.dmp

C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0a7db31b23de98f23e6397f1bf2117cf17705b398f23daf40d14a3ae955acab3.exe

MD5 cb79a05b8d77f8f8c104364b5cddf453
SHA1 1fc1bdfe434726cae20c4ac29c650c9b29925721
SHA256 0a7db31b23de98f23e6397f1bf2117cf17705b398f23daf40d14a3ae955acab3
SHA512 536da708f6e8db5b612c07b479e64fde104ca00b0d6c432282de209756e0b2a46cf4a90fbb38ad02eaf39d79f0eb9a90a543546e32f9ca93362af8038e6cdd47

memory/2524-419-0x00000000021D0000-0x00000000021DC000-memory.dmp

memory/2524-422-0x0000000002180000-0x0000000002189000-memory.dmp

memory/2524-424-0x00000000021D0000-0x00000000021DC000-memory.dmp

memory/4544-429-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-430-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-431-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-432-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-435-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-436-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-437-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-438-0x0000000001100000-0x0000000001620000-memory.dmp

C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.gen-0333c87c90ad38e8b603e64b9355ff846b72c8698a20c7110e086f19a5a74c6b.exe

MD5 ffbfc0975ed1eeae60e65a21f2a028bf
SHA1 8de100a2dcef72cd0cdfaa89e0a9d0d0a0ecab7f
SHA256 0333c87c90ad38e8b603e64b9355ff846b72c8698a20c7110e086f19a5a74c6b
SHA512 45eb377b8869ef76111a0535eb8987450273d693f081b1cb4bcd689594275828ec3b4698acca91706db61a0903386b59bae91714bcff916d689c9877cf491e36

memory/3384-444-0x0000000002360000-0x000000000236C000-memory.dmp

memory/3384-448-0x0000000002250000-0x0000000002259000-memory.dmp

memory/3384-449-0x0000000002360000-0x000000000236C000-memory.dmp

memory/4544-450-0x0000000001100000-0x0000000001620000-memory.dmp

memory/4544-451-0x0000000001100000-0x0000000001620000-memory.dmp

C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-0df724506fe4e48553b6a88790348bf5234756c7761d2d52e83743654c7e1fd1.exe

MD5 6755e9f263c88391c84955a750191dc0
SHA1 204025984f807ee393b090b768799ce162ad2584
SHA256 0df724506fe4e48553b6a88790348bf5234756c7761d2d52e83743654c7e1fd1
SHA512 cee901c24b69e73c542194359df19ced5d77f3876dcb83b641f03b39bcbf55c219524520384b6131d902ce4265d092c597f7493b1cbac1b7666f873f699c920d

C:\Users\Admin\Desktop\HEUR-Backdoor.Win32.Emotet.vho-115cb7215cf91e5fc653e9cb0264e6abc380176b2b5baeed6d9bacd1638134ba.exe

MD5 ab559352745210032f32ee163bb6cc63
SHA1 3dafb0b8f4585e591bd5df28e04e67acbf520388
SHA256 115cb7215cf91e5fc653e9cb0264e6abc380176b2b5baeed6d9bacd1638134ba
SHA512 683d64c94ba56aeafa50e2c5d51f7b796b6af515d3e0230299999edb7a9ea0dbc0c508262fbf58a61c95dbe73437840ab2314ebaeb68039bb9c049001ca0f5a3

memory/3416-491-0x0000000002220000-0x0000000002229000-memory.dmp

C:\Users\Admin\Desktop\HEUR-Exploit.Win32.ShellCode.vho-138c60f8df9c59cf59cbdfbf5004ceda539b0de2cd70207b79833805594a9746.exe

MD5 6b16e6fec7ef4c1b22392ee1dfee68f1
SHA1 36ae3566f044895e453bba9c4d2ac5fa782d03f0
SHA256 138c60f8df9c59cf59cbdfbf5004ceda539b0de2cd70207b79833805594a9746
SHA512 fa8345327cdf6d14542bffd167ecf4c07cf7ce9ea4a68ece09e07c9910e2ea14eb97aad957997898e345d05fe3305e139f097d6a7f027b5130eab3edc2eb446d

memory/3192-523-0x0000000000C40000-0x0000000000C41000-memory.dmp

memory/3192-524-0x0000000002760000-0x0000000002769000-memory.dmp

C:\Users\Admin\Desktop\HEUR-HackTool.Win32.Agent.gen-14e37b6fe4febe9a50e121b612391ffde335fb6530cb1fe7ae82241c2f20cc74.exe

MD5 eaa788b46b816b446437d0cf265b5e6b
SHA1 4b6f515b53ed05cdc2d1bea89f4a94c92a78f3bb
SHA256 14e37b6fe4febe9a50e121b612391ffde335fb6530cb1fe7ae82241c2f20cc74
SHA512 36bd361e6daacc52a5c41a2d4a8fd0ab1c7e0461f90f94f2c3f733c8c557f2522265435ae5267196830bdc5501705209c82720599816328664a7a81d8cc8292b

C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-0fb9d2a859110a1ec0d6c6280c1f7b633637b4cab38cd4cdcc9ded2727dfb35d.exe

MD5 c7182bfb843419d04787a55356bd7bea
SHA1 619d8fc707348d7e001d07bc192d0c804ec451b0
SHA256 0fb9d2a859110a1ec0d6c6280c1f7b633637b4cab38cd4cdcc9ded2727dfb35d
SHA512 be1d12326137f09eb420c64567e82ae036302699243b5f88a5260e2d5ce385f17b0a906b338ad06b4fa913d2468e681a9fe103dd9ab1c3a537ed390ab1624557

memory/1016-598-0x0000000000930000-0x0000000000939000-memory.dmp

C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Cridex.vho-0083be8d814f433107dc77ed0b0d75ae6485e51526a437308df097b2de099086.exe

MD5 77722db4a325c867ce3b779db927550c
SHA1 69ea159d9a021448e9129809b25c260cfaeb3989
SHA256 0083be8d814f433107dc77ed0b0d75ae6485e51526a437308df097b2de099086
SHA512 3b8a401edb5a59511959460376378aef4712c74bf04bdd7e518217b718e8deb549c7b522c9926ced05c0f3735be75cc292cae78b1a2dcc42e1b026a3f3a45b34

C:\Users\Admin\AppData\Roaming\remcos\logs.dat

MD5 656dc95aacee9ff919231026b1c13834
SHA1 cb9c556f57629c0070aa477fd7f3ef57c20c15eb
SHA256 c53fc8d5b9179e970e0daa1a340f9ebfb67c90032fca585775f6720029344760
SHA512 7343666840848adc5e0182b28a5f9758ef6e2b51bd0a18f27a2a51a2f770ff6b4310a524b6373cf3f03f14e23225619189403adf38f940fc73419d35e35955e7

C:\Users\Admin\Desktop\HEUR-Trojan-Spy.AndroidOS.Xagfin.b-02de72e43d578c45d9d6359299cb2d47771081617ff01363b736414eb831deea

MD5 6f7523d3019fa190499f327211e01fcb
SHA1 c492d80fc6797b06105a20b98a0263b239d2ea27
SHA256 02de72e43d578c45d9d6359299cb2d47771081617ff01363b736414eb831deea
SHA512 99d292a24d7a9595dd9185dcab482658f0c84729d4b519a4d8381568d9f3be45b16f9beaf03c7ac17dc3eee08f50a705894f9662c3498fc9b7b247de27cc78f4

C:\Users\Admin\AppData\Roaming\Screenshots\time_20240424_180244.png

MD5 370ab75f900a2b8f97024d3ef3df03ef
SHA1 d926c0870671871bf663cc166227bff05d69135b
SHA256 87bd130af137a73ad3f4e7162526edd3fe3f1d46bec5ec432ed4c4ac51c0ec35
SHA512 68227a0eb27685d6ca8f6d6c1d5bd49f93ec79c05befad1be28ade572ec13eadd31cfd704d484d016609fc94ffe1e642642043236ffe7662b2da578f62ad3a5b

C:\Users\Admin\Desktop\HEUR-Trojan-Spy.Win32.Noon.gen-06de4cc259e1fab7824ccc937c5ad00fc3f316fa6080c96f0e288470125e9eb0.exe

MD5 8492e75da9e24f8f3a4d9f28decfcf57
SHA1 ad8420eac753106a7947fb49e4c3d523ba2411ef
SHA256 06de4cc259e1fab7824ccc937c5ad00fc3f316fa6080c96f0e288470125e9eb0
SHA512 b86acddd6f42762259000e4c38da45a6dbf4e28c5ef0ac266ce7c9cadd01aacb9ffefe97e2e96e071dbf89055240b3b0c0618027c29a86bd1233af0be44559a9

C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Crypt.gen-0c6e6032fbb77b5cbaa08368d3765da6a4e1a6aa6090edf09492e3602be1e91e.exe

MD5 bd2462e402f360b5b994258af437552e
SHA1 c3036f930b86fc58b26a7b4a6e3d9b9b34b50a35
SHA256 0c6e6032fbb77b5cbaa08368d3765da6a4e1a6aa6090edf09492e3602be1e91e
SHA512 271531e82faeb23fdce7c0a6be85916bc59813368e24a941ff115f6ef57e337a500d099fc1e63ed3db8c3434dd73ad44dd20b21478c903aca7f63ecb19a24300

C:\Users\Admin\AppData\Local\Temp\7zE875BCCB6\HEUR-Trojan.MSIL.Inject.gen-12c02f2ee47646b51fea975d0a426421df2f1f0c728327b433f24287360eb3a3

MD5 ef8160901349fb86452c66f224913ebd
SHA1 ddccea12c63c81bc07754cd71ac621eef902a698
SHA256 12c02f2ee47646b51fea975d0a426421df2f1f0c728327b433f24287360eb3a3
SHA512 613f29a169fa7a8285f431d18d4945cf102b0c861e16a3b25367ed634b8838278ea6492db15112b4c5ee9a54b3e73d35bd0d8fe97c80ffd119c22469fdae0345

C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.NetWire.gen-03a2e324ed80e1b205519b0d734e3f90ba7455dbca17d979e28198d675de8c3d.exe

MD5 209ccf1134483ab9a9aa1539bb21343b
SHA1 5127f1e0f1a22e7fd230fc903ea232d67ffa562d
SHA256 03a2e324ed80e1b205519b0d734e3f90ba7455dbca17d979e28198d675de8c3d
SHA512 1224f82e714ec33c408df477409d47246a4bc268d8b8f15ce4f76a50994cdb54878701aad86439d64c1695423d1ad71b97bc60a0607ac3fbd376b052d40ed843

C:\Users\Admin\Desktop\HEUR-Trojan-Dropper.MSIL.Dapato.gen-11e8dbf88b15aa6f09d5f7d9fffd3f333ec9a84b6bb9b9bb8c69dad6f5890603.msi

MD5 7135c4f44145fb609c168e2e48cefaa0
SHA1 9fe8b5bda91407ffbd4e07062acff10aac6bcbd1
SHA256 11e8dbf88b15aa6f09d5f7d9fffd3f333ec9a84b6bb9b9bb8c69dad6f5890603
SHA512 9076a3133c18722dfec922ba1196913f4c0fd19e8a4daafefe699d83465c957b26fe048e53859e9a5a0b51e6727eaef0437caae7304ef8a0fd0abe0dfb4ff8e3

C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Crypt.gen-0b0537b9f976c4a49f1105bc03d252c0cac7a99b9abdb1a020d2966b6a0b1285.exe

MD5 c6ee03f38ee45f360ec0b06050c43b7b
SHA1 6a0fb3630f4a2519a0c6163e6f3c93772a375a00
SHA256 0b0537b9f976c4a49f1105bc03d252c0cac7a99b9abdb1a020d2966b6a0b1285
SHA512 f586cc57417b23d42e100ad893c26958b223ff64f8ae746d90c9b94b80bb1f11df691190033725c2f1f624a0cec1a49d5ab656b2f8d5e1b6284a2f04bd9d8f94

C:\Users\Admin\Desktop\HEUR-Trojan-Spy.Win32.Noon.gen-ceffcce2144e6f7b1724f53f9812b05c6066efb4cf70ba1ff178a0f50d021d30.exe

MD5 c07ac357e1e7cc7e141dc7f85dda5677
SHA1 49ea58795f6dea1af77541352ce7a59c377db608
SHA256 ceffcce2144e6f7b1724f53f9812b05c6066efb4cf70ba1ff178a0f50d021d30
SHA512 64b74cdca023635fb15d9eebffe5c72116d86646bf278950461ab600b1c1b894e2807aef675ca0705849632e6c6adf627655432daf0b4684ab5308a05c5d7723

C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.gen-086c83fc511485a76ff068c50bff11cbe26daa6c9f6e76e6bc15718a0a216d15.exe

MD5 90c69cd00253fb4155d2ae4530445b1c
SHA1 fdfceaeff401490dd227c9638b0834cdad0df436
SHA256 086c83fc511485a76ff068c50bff11cbe26daa6c9f6e76e6bc15718a0a216d15
SHA512 8a10b5051e825bb13874b9a5c630528facfab4946fe13d74c38ed6e078795333a3ca547562203a5b899b803cfa71281341135ed34307909745e23c56faeb20b8

C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-0d79086771a3ec611cccecf0fb92b6b1c7cbc23afdc3fadb05b2940d40e8a1ec.exe

MD5 76b2a029ccdf7dc980e3f39a1219c693
SHA1 7f419f22e6ce5710861c5578ca34ffbfa874254e
SHA256 0d79086771a3ec611cccecf0fb92b6b1c7cbc23afdc3fadb05b2940d40e8a1ec
SHA512 d58e0a1452f7c5d88d0f10acb050c32460ae132c3612a94eda7d53335b6cec803deaaf903e3600204b4f76f49a11169e98976a977f6a385329eb2d0c9732e2b9

C:\Users\Admin\Desktop\HEUR-Trojan-Banker.Win32.Emotet.pef-01b9c4d76d4170d9d8393c117eeba7347af3a6b355bcdf4fd765ab5f1fec6261.exe

MD5 d36f70051c9f86e4bc36c7d83fe1c5cb
SHA1 6f7bddf1459c413a21607cc3739d96c87116601e
SHA256 01b9c4d76d4170d9d8393c117eeba7347af3a6b355bcdf4fd765ab5f1fec6261
SHA512 6453aefc990c18a6f9e8943af4fbca33e74acdc6b9fdc4f29f17e9ab4ef43a5de7ffe9bf76502e2bf380a0ad0b0debfbef47651a657b595537ac028565733a52

memory/1144-908-0x00000000004B0000-0x00000000004B9000-memory.dmp

C:\Users\Admin\Desktop\HEUR-Trojan.MSIL.Hesv.gen-0fe7af2933781cea89408cc70b9563727d7d4e96dc9a7d18d8d92460823e0a9f.exe

MD5 5737d1acc70ed4c7085a9e69b9e7216e
SHA1 0601ecdf6c8e7559a405855756a80cda08407b38
SHA256 0fe7af2933781cea89408cc70b9563727d7d4e96dc9a7d18d8d92460823e0a9f
SHA512 639bcf98fbb7c5f8bd5e1b8691f83a9d59671fa1cef45590d14998e7e3ecbde975d2ead61109d3692dd8aa80f0d8d87c7da99f860632abb610eb70b706a35832

memory/3260-922-0x0000000071390000-0x0000000071B40000-memory.dmp

memory/2188-918-0x0000000071390000-0x0000000071B40000-memory.dmp

memory/2188-915-0x0000000000B30000-0x0000000000C84000-memory.dmp

C:\Users\Admin\Desktop\HEUR-Trojan-PSW.MSIL.Agensla.gen-13af67261cdde6647fc4c1669ced247f69a2e03b08e62dfea53a3af3d4a867da.exe

MD5 d1b2d539c4e64daed977e74f059d69ff
SHA1 dad5afc6d77226c8c233fc738f95f1d593adda07
SHA256 13af67261cdde6647fc4c1669ced247f69a2e03b08e62dfea53a3af3d4a867da
SHA512 e722f149ecaa696281538575f6cbf40e95fd42dbdb396c0b49e5ae34de098c4a737599f2accebca6092ba6480291a6aeab16509b9d6313b1ea12eed4ca5939c0

memory/1312-928-0x00000000005F0000-0x00000000005F9000-memory.dmp

memory/2188-920-0x0000000005510000-0x00000000055AC000-memory.dmp

memory/2188-926-0x0000000005B60000-0x0000000006104000-memory.dmp

memory/1056-933-0x0000000000D50000-0x0000000000E38000-memory.dmp

memory/2188-932-0x0000000005650000-0x00000000056E2000-memory.dmp

memory/740-941-0x0000000002140000-0x0000000002141000-memory.dmp

memory/740-936-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/3260-924-0x0000000000210000-0x000000000038E000-memory.dmp

memory/3260-946-0x0000000004E00000-0x0000000004E10000-memory.dmp

memory/3260-949-0x0000000004D90000-0x0000000004D9A000-memory.dmp

memory/2188-953-0x0000000005840000-0x0000000005896000-memory.dmp

memory/4556-957-0x0000000002330000-0x0000000002339000-memory.dmp

memory/2188-956-0x00000000055F0000-0x0000000005600000-memory.dmp

memory/1056-959-0x0000000005840000-0x0000000005850000-memory.dmp

memory/1056-955-0x0000000071390000-0x0000000071B40000-memory.dmp

memory/1200-951-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2188-945-0x00000000055D0000-0x00000000055DA000-memory.dmp

memory/1200-962-0x0000000076AA0000-0x0000000076B90000-memory.dmp

memory/1200-964-0x0000000000C70000-0x0000000000C80000-memory.dmp

memory/1200-967-0x0000000000C70000-0x0000000000C80000-memory.dmp

memory/1200-970-0x0000000000C70000-0x0000000000C80000-memory.dmp

memory/1200-973-0x0000000076AA0000-0x0000000076B90000-memory.dmp

memory/1056-972-0x0000000005960000-0x0000000005970000-memory.dmp

memory/1200-975-0x0000000076AA0000-0x0000000076B90000-memory.dmp

memory/1200-977-0x0000000076AA0000-0x0000000076B90000-memory.dmp

memory/1200-979-0x0000000000C70000-0x0000000000C80000-memory.dmp

memory/1200-978-0x0000000077032000-0x0000000077033000-memory.dmp

memory/1200-982-0x0000000000A20000-0x0000000000A30000-memory.dmp

memory/1200-983-0x000000006DA20000-0x000000006DFD1000-memory.dmp

memory/1200-985-0x0000000076AA0000-0x0000000076B90000-memory.dmp

memory/1200-986-0x0000000076AA0000-0x0000000076B90000-memory.dmp

memory/1200-987-0x0000000077032000-0x0000000077033000-memory.dmp

memory/1200-989-0x0000000000C70000-0x0000000000C80000-memory.dmp

memory/1200-988-0x0000000000C70000-0x0000000000C80000-memory.dmp

memory/1200-990-0x000000006DA20000-0x000000006DFD1000-memory.dmp

memory/1200-991-0x0000000076AA0000-0x0000000076B90000-memory.dmp

memory/3076-1016-0x0000000000D40000-0x0000000000D41000-memory.dmp

memory/2188-1012-0x0000000071390000-0x0000000071B40000-memory.dmp

memory/3260-1006-0x0000000071390000-0x0000000071B40000-memory.dmp

memory/3260-1021-0x0000000004E00000-0x0000000004E10000-memory.dmp

memory/1200-1023-0x0000000000400000-0x000000000047F000-memory.dmp

memory/1056-1026-0x0000000005840000-0x0000000005850000-memory.dmp

memory/1200-1031-0x0000000076AA0000-0x0000000076B90000-memory.dmp

memory/1056-1036-0x0000000071390000-0x0000000071B40000-memory.dmp

memory/1200-1040-0x0000000000C70000-0x0000000000C80000-memory.dmp

memory/2188-1038-0x0000000005830000-0x0000000005840000-memory.dmp

memory/1200-1043-0x0000000000C70000-0x0000000000C80000-memory.dmp

memory/1200-1045-0x0000000000C70000-0x0000000000C80000-memory.dmp

memory/1200-1047-0x0000000000C70000-0x0000000000C80000-memory.dmp

memory/1200-1049-0x0000000000C70000-0x0000000000C80000-memory.dmp

memory/1200-1051-0x0000000076AA0000-0x0000000076B90000-memory.dmp

memory/1200-1050-0x0000000076AA0000-0x0000000076B90000-memory.dmp

memory/1200-1052-0x0000000076AA0000-0x0000000076B90000-memory.dmp