qakbot | 2e774230640debe52a0ff7f4aa9ccdc5b2b271192492b773b41b827ef41f4674

Resubmissions

25-05-2020 16:07

200525-ddd1ggsbdj 10

Analysis

max time kernel
1031s
max time network
1799s
platform
windows7_x64
resource
win7v200430
submitted
25-05-2020 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kaufvertrag_648230011400_21052020.vbs
Size

36.3MB
MD5

86d77e33adbd08281bde87c925026219
SHA1

62393354f0037c8f56ebc33606b43ee71de3079b
SHA256

bfca22cf77eb45df30fa08fa3995163683633919c30332d60d015eaf23544194
SHA512

d1a0dc4c63e8e309366eb48bf9d124a546dfa689636880d968b80ddb92548f3d21043cd2fe22b8ea5673648c0ee1ee0c533323062579cd5bd7960a4a6e694368

Score

10^/10

qakbot notset spx125 1588850855 1590138228 banker cryptone evasion packer persistence stealer trojan

Malware Config

Extracted

Family

qakbot

Botnet

spx125

Campaign

1590138228

190.75.168.108:2078

93.114.192.211:2222

47.39.76.74:443

182.56.134.44:995

24.201.79.208:2078

207.246.71.122:443

50.244.112.10:443

88.207.27.144:443

72.204.242.138:443

72.204.242.138:2078

72.204.242.138:990

76.187.8.160:443

220.135.31.140:2222

86.126.97.183:2222

86.126.112.153:995

68.49.120.179:443

101.108.125.44:443

203.101.163.187:443

197.165.212.10:443

207.255.161.8:2078

Extracted

Family

qakbot

Botnet

notset

Campaign

1588850855

Credentials

Protocol: ftp
Host:
192.185.5.208
Port:
21
Username:
[email protected]
Password:
NxdkxAp4dUsY

Protocol: ftp
Host:
162.241.218.118
Port:
21
Username:
[email protected]
Password:
EcOV0DyGVgVN

Protocol: ftp
Host:
69.89.31.139
Port:
21
Username:
[email protected]
Password:
fcR7OvyLrMW6!

Protocol: ftp
Host:
169.207.67.14
Port:
21
Username:
[email protected]
Password:
eQyicNLzzqPN

24.110.14.40:443

96.35.170.82:2222

50.78.93.74:443

76.187.97.98:2222

202.77.4.37:443

89.38.171.30:443

66.26.160.37:443

58.108.188.231:443

67.83.54.76:2222

102.41.116.213:995

78.96.245.58:443

176.193.14.165:2222

73.1.68.242:443

96.37.113.36:443

98.22.234.245:443

76.15.41.32:443

95.77.235.132:0

24.226.137.154:443

24.99.180.247:443

24.43.22.220:995

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

CryptOne packer 23 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
behavioral1/files/0x00040000000131b4-0.dat	cryptone
behavioral1/files/0x00040000000131b4-2.dat	cryptone
behavioral1/files/0x00040000000131b4-3.dat	cryptone
behavioral1/files/0x00040000000131b4-4.dat	cryptone
behavioral1/files/0x00030000000131ba-6.dat	cryptone
behavioral1/files/0x00030000000131ba-7.dat	cryptone
behavioral1/files/0x00030000000131ba-8.dat	cryptone
behavioral1/files/0x00030000000131ba-9.dat	cryptone
behavioral1/files/0x00030000000131ba-10.dat	cryptone
behavioral1/files/0x00040000000131b4-14.dat	cryptone
behavioral1/files/0x00030000000131ba-15.dat	cryptone
behavioral1/files/0x00030000000131ba-16.dat	cryptone
behavioral1/files/0x00030000000131ba-17.dat	cryptone
behavioral1/files/0x00130000000131bb-19.dat	cryptone
behavioral1/files/0x00130000000131bb-20.dat	cryptone
behavioral1/files/0x00130000000131bb-21.dat	cryptone
behavioral1/files/0x00030000000131ba-22.dat	cryptone
behavioral1/files/0x00030000000131ba-23.dat	cryptone
behavioral1/files/0x00030000000131ba-24.dat	cryptone
behavioral1/files/0x00030000000131ba-25.dat	cryptone
behavioral1/files/0x00030000000131ba-26.dat	cryptone
behavioral1/files/0x00030000000131ba-27.dat	cryptone
behavioral1/files/0x00030000000131ba-28.dat	cryptone

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	1016	WScript.exe

Executes dropped EXE 11 IoCs

pid	Process
464	PicturesViewer.exe
976	PicturesViewer.exe
1296	oovgku.exe
1596	oovgku.exe
1484	PicturesViewer.exe
1676	oovgku.exe
316	oovgku.exe
1956	gzsimndyjihsrmcsgwxdsyceehqpeq.exe
1652	oovgku.exe
1532	oovgku.exe
1332	oovgku.exe

Loads dropped DLL 9 IoCs

pid	Process
464	PicturesViewer.exe
464	PicturesViewer.exe
464	PicturesViewer.exe
1484	PicturesViewer.exe
1580	explorer.exe
1580	explorer.exe
1580	explorer.exe
1580	explorer.exe
1580	explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\zmcqct = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Wnreo\\oovgku.exe\""	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1584	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab312388000000000200000000001066000000010000200000008e6b66e95ea528b716694ff3cbbd9d40fb6cdb8ad823e8b4bbaba3ce7bc5f36c000000000e8000000002000020000000905cd1103a896dcaaba4ca8f17df4f61c45064af2a7380e866da1fe640414cb190000000b6e5b454bc5108bbb0e49440d19721b6442d83f7b875f5c44d1d37da9c3f13d0321d1c3ffb9b696b46941c3e376666b0734b62a852589b9123ef622500627e6fc8264b96a0c39b038c9cd2f5612716aae7884a1c2f5fca4eb36dfefa3d5c1e4e5350de16502f5319ec25179ae6fe069e7d6e7cfa857c74635ad03c18888c28a55d41f606c4b67344e1ecb53ccd56b2614000000044008d0fc402f1845020bb850354f03fc83cc74b9f27b7743fe4e768afc71a2c7a988db99b39b02e9318551ac18f64cd9acb7e24de191daadb5887b6025c96d7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E95F1531-9EB4-11EA-818A-DE6ED157E5B6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cf8d5bd09b0364592b95b96ab31238800000000020000000000106600000001000020000000bc93e1c5c71f4d68d837b468d9ef3871d015f18effdfe8aa4150ca0076cde7a4000000000e80000000020000200000005ef80d8f4150e9af1702cf38f02f7f78a738ed70d1417576030139626a746307200000009230e50956897cbcd12c17028a7cb4199061dd4a0e0a84e4b116c7f49048cf1a40000000477be4fe72f3168522c884e9c021c492abf6ed6eee7a2b03055caed385a3e40437b1da1bf7b7438b6750a821dc1db190e3bfb059ab13da0cd5eb16e2d2269f65	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3001e2b6c132d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PicturesViewer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	PicturesViewer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	PicturesViewer.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
728	PING.EXE
1732	ping.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
464	PicturesViewer.exe
976	PicturesViewer.exe
976	PicturesViewer.exe
1296	oovgku.exe
1596	oovgku.exe
1596	oovgku.exe
1580	explorer.exe
1580	explorer.exe
1484	PicturesViewer.exe
1676	oovgku.exe
316	oovgku.exe
316	oovgku.exe
1580	explorer.exe
1580	explorer.exe
1956	gzsimndyjihsrmcsgwxdsyceehqpeq.exe
1652	oovgku.exe
1532	oovgku.exe
1332	oovgku.exe
1332	oovgku.exe
1028	explorer.exe
1928	explorer.exe
1164	taskhost.exe
1272	Dwm.exe
784	DllHost.exe
1336	Explorer.EXE
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe
1928	explorer.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1296	oovgku.exe
1532	oovgku.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1336	Explorer.EXE
Token: SeManageVolumePrivilege	1532	explorer.exe
Token: SeShutdownPrivilege	1336	Explorer.EXE
Token: SeShutdownPrivilege	1336	Explorer.EXE
Token: SeShutdownPrivilege	1336	Explorer.EXE
Token: SeShutdownPrivilege	1336	Explorer.EXE
Token: SeShutdownPrivilege	1336	Explorer.EXE
Token: SeShutdownPrivilege	1336	Explorer.EXE

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
2788	iexplore.exe
2788	iexplore.exe
2868	firefox.exe
2868	firefox.exe
2868	firefox.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
1576	chrome.exe
2868	firefox.exe
2868	firefox.exe
2868	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2788	iexplore.exe
2788	iexplore.exe
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2788	iexplore.exe
2788	iexplore.exe
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 464	1016	WScript.exe	27
PID 1016 wrote to memory of 464	1016	WScript.exe	27
PID 1016 wrote to memory of 464	1016	WScript.exe	27
PID 1016 wrote to memory of 464	1016	WScript.exe	27
PID 464 wrote to memory of 976	464	PicturesViewer.exe	28
PID 464 wrote to memory of 976	464	PicturesViewer.exe	28
PID 464 wrote to memory of 976	464	PicturesViewer.exe	28
PID 464 wrote to memory of 976	464	PicturesViewer.exe	28
PID 464 wrote to memory of 1296	464	PicturesViewer.exe	29
PID 464 wrote to memory of 1296	464	PicturesViewer.exe	29
PID 464 wrote to memory of 1296	464	PicturesViewer.exe	29
PID 464 wrote to memory of 1296	464	PicturesViewer.exe	29
PID 464 wrote to memory of 1584	464	PicturesViewer.exe	30
PID 464 wrote to memory of 1584	464	PicturesViewer.exe	30
PID 464 wrote to memory of 1584	464	PicturesViewer.exe	30
PID 464 wrote to memory of 1584	464	PicturesViewer.exe	30
PID 1296 wrote to memory of 1596	1296	oovgku.exe	32
PID 1296 wrote to memory of 1596	1296	oovgku.exe	32
PID 1296 wrote to memory of 1596	1296	oovgku.exe	32
PID 1296 wrote to memory of 1596	1296	oovgku.exe	32
PID 1296 wrote to memory of 1580	1296	oovgku.exe	33
PID 1296 wrote to memory of 1580	1296	oovgku.exe	33
PID 1296 wrote to memory of 1580	1296	oovgku.exe	33
PID 1296 wrote to memory of 1580	1296	oovgku.exe	33
PID 1296 wrote to memory of 1580	1296	oovgku.exe	33
PID 1972 wrote to memory of 1484	1972	taskeng.exe	37
PID 1972 wrote to memory of 1484	1972	taskeng.exe	37
PID 1972 wrote to memory of 1484	1972	taskeng.exe	37
PID 1972 wrote to memory of 1484	1972	taskeng.exe	37
PID 1484 wrote to memory of 664	1484	PicturesViewer.exe	38
PID 1484 wrote to memory of 664	1484	PicturesViewer.exe	38
PID 1484 wrote to memory of 664	1484	PicturesViewer.exe	38
PID 1484 wrote to memory of 664	1484	PicturesViewer.exe	38
PID 1484 wrote to memory of 1232	1484	PicturesViewer.exe	40
PID 1484 wrote to memory of 1232	1484	PicturesViewer.exe	40
PID 1484 wrote to memory of 1232	1484	PicturesViewer.exe	40
PID 1484 wrote to memory of 1232	1484	PicturesViewer.exe	40
PID 1484 wrote to memory of 1332	1484	PicturesViewer.exe	42
PID 1484 wrote to memory of 1332	1484	PicturesViewer.exe	42
PID 1484 wrote to memory of 1332	1484	PicturesViewer.exe	42
PID 1484 wrote to memory of 1332	1484	PicturesViewer.exe	42
PID 1484 wrote to memory of 436	1484	PicturesViewer.exe	44
PID 1484 wrote to memory of 436	1484	PicturesViewer.exe	44
PID 1484 wrote to memory of 436	1484	PicturesViewer.exe	44
PID 1484 wrote to memory of 436	1484	PicturesViewer.exe	44
PID 1484 wrote to memory of 1756	1484	PicturesViewer.exe	46
PID 1484 wrote to memory of 1756	1484	PicturesViewer.exe	46
PID 1484 wrote to memory of 1756	1484	PicturesViewer.exe	46
PID 1484 wrote to memory of 1756	1484	PicturesViewer.exe	46
PID 1484 wrote to memory of 1028	1484	PicturesViewer.exe	48
PID 1484 wrote to memory of 1028	1484	PicturesViewer.exe	48
PID 1484 wrote to memory of 1028	1484	PicturesViewer.exe	48
PID 1484 wrote to memory of 1028	1484	PicturesViewer.exe	48
PID 1484 wrote to memory of 1780	1484	PicturesViewer.exe	50
PID 1484 wrote to memory of 1780	1484	PicturesViewer.exe	50
PID 1484 wrote to memory of 1780	1484	PicturesViewer.exe	50
PID 1484 wrote to memory of 1780	1484	PicturesViewer.exe	50
PID 1484 wrote to memory of 584	1484	PicturesViewer.exe	52
PID 1484 wrote to memory of 584	1484	PicturesViewer.exe	52
PID 1484 wrote to memory of 584	1484	PicturesViewer.exe	52
PID 1484 wrote to memory of 584	1484	PicturesViewer.exe	52
PID 1484 wrote to memory of 1384	1484	PicturesViewer.exe	54
PID 1484 wrote to memory of 1384	1484	PicturesViewer.exe	54
PID 1484 wrote to memory of 1384	1484	PicturesViewer.exe	54

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1164

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1272

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1336
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Kaufvertrag_648230011400_21052020.vbs"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
    C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
      C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe /C
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:976
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1296
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe /C
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1596
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        Loads dropped DLL
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:1580
      - C:\Users\Admin\gzsimndyjihsrmcsgwxdsyceehqpeq.exe
        
        "C:\Users\Admin\gzsimndyjihsrmcsgwxdsyceehqpeq.exe" /W
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1956
      - C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe" /W
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1652
      - C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1532
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe /C
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1332
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1028
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        8⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        8⤵
        
        PID:2036
        
        C:\Windows\system32\ping.exe
        
        C:\Windows\system32\ping.exe -t 127.0.0.1
        9⤵
        Runs ping.exe
        
        PID:1732
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c "rmdir /S /Q "C:\Users\Admin\EmailStorage_DJRWGDLZ-Admin_1590430698""
        10⤵
        
        PID:1596
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c rmdir /S /Q "C:\Users\Admin\EmailStorage_DJRWGDLZ-Admin_1590430698"
        10⤵
        
        PID:1380
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1928
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        8⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" http://a.strandsglobal.com/redir_chrome.html
        9⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1576
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=81.0.4044.129 --initial-client-data=0xa4,0xa8,0xac,0x78,0xb0,0x7fef756bd28,0x7fef756bd38,0x7fef756bd48
        10⤵
        
        PID:1732
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=1988 --on-initialized-event-handle=372 --parent-handle=376 /prefetch:6
        10⤵
        
        PID:1104
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1120 --ignored=" --type=renderer " /prefetch:2
        10⤵
        
        PID:1304
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1296 /prefetch:8
        10⤵
        
        PID:1912
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1928 /prefetch:1
        10⤵
        
        PID:1040
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1
        10⤵
        
        PID:1672
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2436 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:2040
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2524 --ignored=" --type=renderer " /prefetch:2
        10⤵
        
        PID:1992
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=820 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:848
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --disable-gpu-compositing --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2820 /prefetch:1
        10⤵
        
        PID:1300
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2656 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:2316
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2768 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:2360
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2648 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:2408
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2764 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:2456
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --disable-gpu-compositing --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
        10⤵
        
        PID:2504
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --disable-gpu-compositing --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
        10⤵
        
        PID:2624
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --no-sandbox --enable-audio-service-sandbox --mojo-platform-channel-handle=3892 /prefetch:8
        10⤵
        
        PID:2608
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=4012 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:2732
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3112 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:2812
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=4000 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:2896
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3476 --ignored=" --type=renderer " /prefetch:8
        10⤵
        
        PID:3040
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --disable-gpu-compositing --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
        10⤵
        
        PID:2144
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1088,17700626457900721779,8139213244210543413,131072 --lang=en-US --no-sandbox --enable-audio-service-sandbox --mojo-platform-channel-handle=2504 /prefetch:8
        10⤵
        
        PID:2780
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" https://en.wikipedia.org/wiki/Google_Chrome
        9⤵
        
        PID:2528
        
        C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=81.0.4044.129 --initial-client-data=0xa4,0xa8,0xac,0x78,0xb0,0x7fef756bd28,0x7fef756bd38,0x7fef756bd48
        10⤵
        
        PID:2564
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" http://a.strandsglobal.com/redir_ff.html
        9⤵
        
        PID:2664
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" http://a.strandsglobal.com/redir_ff.html
        10⤵
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2868
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.0.173046202\2017778248" -parentBuildID 20200403170909 -prefsHandle 1184 -prefMapHandle 1176 -prefsLen 1 -prefMapSize 219627 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 1276 gpu
        11⤵
        
        PID:2368
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.3.1758841169\741188648" -childID 1 -isForBrowser -prefsHandle 1740 -prefMapHandle 1736 -prefsLen 122 -prefMapSize 219627 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 1752 tab
        11⤵
        
        PID:2984
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2868.13.1838609176\696642752" -childID 2 -isForBrowser -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 162 -prefMapSize 219627 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2868 "\\.\pipe\gecko-crash-server-pipe.2868" 2004 tab
        11⤵
        
        PID:2548
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.mozilla.org/en-US/firefox/new/
        9⤵
        
        PID:2792
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.mozilla.org/en-US/firefox/new/
        10⤵
        Checks processor information in registry
        
        PID:2804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://a.strandsglobal.com/redir_ie.html
        9⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:2788
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:275457 /prefetch:2
        10⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2192
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:209935 /prefetch:2
        10⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2976
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://a.strandsglobal.com/redir_ie.html
        9⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C start microsoft-edge:http://a.strandsglobal.com/redir_ie.html
        9⤵
        
        PID:2360
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn nnctjjzkc /tr "\"C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe\" /I nnctjjzkc" /SC ONCE /Z /ST 18:11 /ET 18:23
      4⤵
      Creates scheduled task(s)
      PID:1584

C:\Windows\system32\taskeng.exe
taskeng.exe {0964705B-0BED-46D5-AC7B-D7AD2C981500} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe
  C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe /I nnctjjzkc
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
    3⤵
    PID:664
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
    3⤵
    PID:1232
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
    3⤵
    PID:1332
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
    3⤵
    PID:436
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
    3⤵
    PID:1756
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
    3⤵
    PID:1028
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
    3⤵
    PID:1780
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
    3⤵
    PID:584
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo" /d "0"
    3⤵
    PID:1384
- - C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1676
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Wnreo\oovgku.exe /C
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:316
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\PicturesViewer.exe"
    3⤵
    PID:1080
  - - C:\Windows\system32\PING.EXE
      ping.exe -n 6 127.0.0.1
      4⤵
      Runs ping.exe
      PID:728
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /DELETE /F /TN nnctjjzkc
    3⤵
    PID:1524

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:784

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:3028

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "12828557171773602869-1471060997-430253134-1596381525-18238905301354321910-1607829069"
1⤵
PID:2492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-18-0x0000000002200000-0x0000000002211000-memory.dmp

Filesize
68KB

Download
memory/784-917-0x00000000023C0000-0x00000000023C8000-memory.dmp

Filesize
32KB

Download
memory/784-1103-0x00000000023E0000-0x00000000023E8000-memory.dmp

Filesize
32KB

Download
memory/784-915-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/784-914-0x0000000002500000-0x0000000002508000-memory.dmp

Filesize
32KB

Download
memory/784-912-0x0000000002200000-0x0000000002208000-memory.dmp

Filesize
32KB

Download
memory/848-164-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/976-5-0x0000000002300000-0x0000000002311000-memory.dmp

Filesize
68KB

Download
memory/1016-1-0x0000000003090000-0x0000000003094000-memory.dmp

Filesize
16KB

Download
memory/1028-33-0x00000000029B0000-0x00000000029E2000-memory.dmp

Filesize
200KB

Download
memory/1028-41-0x0000000000D40000-0x0000000000D72000-memory.dmp

Filesize
200KB

Download
memory/1028-34-0x0000000000DA0000-0x0000000000DD2000-memory.dmp

Filesize
200KB

Download
memory/1028-36-0x0000000000DA0000-0x0000000000DD2000-memory.dmp

Filesize
200KB

Download
memory/1028-38-0x0000000002A10000-0x0000000002A42000-memory.dmp

Filesize
200KB

Download
memory/1040-103-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/1296-12-0x0000000000390000-0x00000000003CA000-memory.dmp

Filesize
232KB

Download
memory/1300-181-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-183-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-202-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-201-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-200-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-199-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-198-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-197-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-196-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-195-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-203-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-210-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-194-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-193-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-192-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-209-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-190-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-189-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-188-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-187-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-186-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-185-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-184-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-182-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-180-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-179-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-178-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-177-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-176-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-175-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-174-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-173-0x0000000009F10000-0x0000000009F21000-memory.dmp

Filesize
68KB

Download
memory/1300-216-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-208-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-214-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-213-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-212-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-211-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-344-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-191-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-215-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-207-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-206-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-205-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-204-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-172-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1300-167-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/1300-171-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1304-97-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/1304-100-0x0000000077800000-0x0000000077801000-memory.dmp

Filesize
4KB

Download
memory/1304-98-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/1332-29-0x0000000002340000-0x0000000002351000-memory.dmp

Filesize
68KB

Download
memory/1532-42-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

Filesize
64KB

Download
memory/1532-82-0x00000000029C0000-0x0000000002A40000-memory.dmp

Filesize
512KB

Download
memory/1532-83-0x0000000000C60000-0x0000000000C80000-memory.dmp

Filesize
128KB

Download
memory/1532-80-0x0000000000B50000-0x0000000000B70000-memory.dmp

Filesize
128KB

Download
memory/1532-60-0x0000000000AF0000-0x0000000000B50000-memory.dmp

Filesize
384KB

Download
memory/1532-54-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Filesize
384KB

Download
memory/1532-30-0x0000000000370000-0x00000000003AA000-memory.dmp

Filesize
232KB

Download
memory/1532-78-0x0000000000B50000-0x0000000000B60000-memory.dmp

Filesize
64KB

Download
memory/1532-48-0x0000000000AF0000-0x0000000000B00000-memory.dmp

Filesize
64KB

Download
memory/1576-224-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-225-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-222-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-232-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-233-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-234-0x000000001CDD0000-0x000000001CDF3000-memory.dmp

Filesize
140KB

Download
memory/1576-235-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-236-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-237-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-226-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-228-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-223-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-231-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-221-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-220-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-229-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1576-218-0x0000000020650000-0x0000000020661000-memory.dmp

Filesize
68KB

Download
memory/1596-11-0x00000000022E0000-0x00000000022F1000-memory.dmp

Filesize
68KB

Download
memory/1672-139-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-124-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-158-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-157-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-156-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-155-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-154-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-153-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-152-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-151-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-150-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-149-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-148-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-147-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-146-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-145-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-144-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-143-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-142-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-141-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-140-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-138-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-137-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-136-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-135-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-134-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-133-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-132-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-131-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-130-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-129-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-128-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-125-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-126-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-123-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-122-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-106-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/1672-127-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-121-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-113-0x000005E900040000-0x000005E900041000-memory.dmp

Filesize
4KB

Download
memory/1672-115-0x00000000080F0000-0x0000000008101000-memory.dmp

Filesize
68KB

Download
memory/1672-116-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-117-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-118-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-119-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1672-120-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1992-161-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2040-111-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2144-677-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-709-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-643-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2144-675-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-676-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-706-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-695-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-694-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-693-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-692-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-691-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-690-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-689-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-688-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-687-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-686-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-685-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-684-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-683-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-682-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-681-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-680-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-679-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-678-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-652-0x0000000009BE0000-0x0000000009BF1000-memory.dmp

Filesize
68KB

Download
memory/2144-651-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-653-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-674-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-673-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-672-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-671-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-670-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-669-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-668-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-667-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-666-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-665-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-664-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-663-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-662-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-661-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-660-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-659-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-658-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-657-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-656-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-655-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2144-654-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2316-239-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2360-242-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2408-245-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2456-248-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2504-272-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-305-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-251-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2504-260-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-261-0x0000000009F40000-0x0000000009F51000-memory.dmp

Filesize
68KB

Download
memory/2504-263-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-264-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-265-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-266-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-267-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-268-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-269-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-270-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-271-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-273-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-274-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-275-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-276-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-277-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-278-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-279-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-280-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-281-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-282-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-283-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-284-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-285-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-286-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-287-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-288-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-289-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-290-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-291-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-292-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-293-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-294-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-295-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-296-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-297-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-298-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-299-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-300-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-301-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-302-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-303-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2504-304-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-353-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-354-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-312-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-311-0x0000000009E40000-0x0000000009E51000-memory.dmp

Filesize
68KB

Download
memory/2624-310-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-314-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-315-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-316-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-317-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-318-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-319-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-320-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-321-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-322-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-323-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-324-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-325-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-328-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-257-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2624-329-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-330-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-331-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-357-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-356-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-355-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-313-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-327-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-352-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-351-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-350-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-349-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-348-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-347-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-326-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-343-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-342-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-341-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-340-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-339-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-338-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-337-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-336-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-335-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-334-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-333-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2624-332-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2732-612-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2792-616-0x0000000000060000-0x0000000000070000-memory.dmp

Filesize
64KB

Download
memory/2812-617-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/2896-621-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download
memory/3040-633-0x000000013FA00FC0-0x000000013FA01110-memory.dmp

Filesize
336B

Download