Overview

overview

10

Static

static

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

8

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

8

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ฺฺ

windows10_x64

8

ﱞﱞﱞ�...ฺฺ

windows10_x64

10

ﱞﱞﱞ�...ฺฺ

windows10_x64

10

ﱞﱞﱞ�...ฺฺ

windows10_x64

8

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

8

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

9

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

8

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows7_x64

8

ﱞﱞﱞ�...ﱞﱞ

windows7_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows7_x64

ﱞﱞﱞ�...ﱞﱞ

windows7_x64

10

win102

windows10_x64

8

win102

windows10_x64

8

win102

windows10_x64

8

win102

windows10_x64

8

win104

windows10_x64

10

win104

windows10_x64

10

win104

windows10_x64

10

win104

windows10_x64

8

win105

windows10_x64

10

win105

windows10_x64

8

win105

windows10_x64

8

win105

windows10_x64

8

Resubmissions

12-11-2024 01:29

241112-bwgrxs1gnf 10

08-07-2021 12:18

210708-8z6d5h8z2n 10

06-07-2021 17:53

210706-g6we6sa7sa 10

19-06-2021 18:17

210619-vr8bj2dzfn 10

17-06-2021 21:39

210617-a9cvlnmrbx 10

11-06-2021 17:26

210611-wvab1yw2tj 10

08-06-2021 06:47

210608-qrbpch3y46 10

08-06-2021 06:47

210608-64tndgm1ln 10

05-06-2021 18:40

210605-cd6qpr55sx 10

04-06-2021 11:56

210604-5c416rs3ns 10

Analysis

  • max time kernel
    57s
  • max time network
    197s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    19-05-2021 18:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Install2.exe

Score
10/10
redlinevidar827discoveryevasioninfostealerpersistencestealerupxvmprotect

Malware Config

Extracted

Family

vidar

Version

38.8

Botnet

827

C2

https://HAL9THapi.faceit.comlegomind

Attributes
  • profile_id

    827

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Vidar Stealer 2 IoCs
    stealer
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 31 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 9 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 10 IoCs
  • Modifies system certificate store 2 TTPs 14 IoCs
    evasionspywaretrojan
  • Script User-Agent 11 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:468
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Modifies registry class
        PID:856
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        2⤵
        • Enumerates connected drives
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        PID:2532
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 2EB663811853AD4252DCCEB7431C0E37 C
          3⤵
          • Loads dropped DLL
          PID:2820
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding C7C5ED681751DEF4AABA9F030C747120
          3⤵
          • Loads dropped DLL
          PID:2700
          • C:\Windows\SysWOW64\taskkill.exe
            "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
            4⤵
            • Kills process with taskkill
            PID:2884
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 85CCCBCF5686DFA8C3541CD9124DD757 M Global\MSI0000
          3⤵
            PID:2948
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          PID:3020
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
            PID:3104
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k SystemNetworkService
            2⤵
              PID:2884
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k SystemNetworkService
              2⤵
                PID:4180
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k SystemNetworkService
                2⤵
                  PID:2852
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                  2⤵
                    PID:3556
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                    2⤵
                      PID:5024
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                      2⤵
                        PID:5008
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                        2⤵
                          PID:3964
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                          2⤵
                            PID:4212
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                            2⤵
                              PID:3880
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                              2⤵
                                PID:3480
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                2⤵
                                  PID:3940
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                  2⤵
                                    PID:3560
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                    2⤵
                                      PID:5016
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                      2⤵
                                        PID:4360
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                        2⤵
                                          PID:4380
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                          2⤵
                                            PID:3360
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                            2⤵
                                              PID:5000
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                              2⤵
                                                PID:4888
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                2⤵
                                                  PID:4620
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                  2⤵
                                                    PID:4476
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                    2⤵
                                                      PID:2760
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                      2⤵
                                                        PID:2676
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                        2⤵
                                                          PID:4664
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                          2⤵
                                                            PID:4584
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                            2⤵
                                                              PID:3780
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                              2⤵
                                                                PID:4680
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                2⤵
                                                                  PID:2396
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                  2⤵
                                                                    PID:3448
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                    2⤵
                                                                      PID:4472
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                      2⤵
                                                                        PID:2320
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                        2⤵
                                                                          PID:4272
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                          2⤵
                                                                            PID:2688
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                            2⤵
                                                                              PID:2424
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                              2⤵
                                                                                PID:1972
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                2⤵
                                                                                  PID:2088
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                  2⤵
                                                                                    PID:2444
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                    2⤵
                                                                                      PID:4604
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                      2⤵
                                                                                        PID:1440
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                        2⤵
                                                                                          PID:3012
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                          2⤵
                                                                                            PID:2368
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                            2⤵
                                                                                              PID:2888
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                              2⤵
                                                                                                PID:3868
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                2⤵
                                                                                                  PID:1060
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                  2⤵
                                                                                                    PID:3872
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                    2⤵
                                                                                                      PID:3236
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                      2⤵
                                                                                                        PID:2384
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                        2⤵
                                                                                                          PID:3256
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                          2⤵
                                                                                                            PID:2180
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                            2⤵
                                                                                                              PID:3096
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                              2⤵
                                                                                                                PID:1748
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                2⤵
                                                                                                                  PID:4284
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                  2⤵
                                                                                                                    PID:3228
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                    2⤵
                                                                                                                      PID:988
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                      2⤵
                                                                                                                        PID:2868
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                        2⤵
                                                                                                                          PID:1052
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                          2⤵
                                                                                                                            PID:4000
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                            2⤵
                                                                                                                              PID:1740
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                              2⤵
                                                                                                                                PID:4288
                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                2⤵
                                                                                                                                  PID:4480
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                  2⤵
                                                                                                                                    PID:4652
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                    2⤵
                                                                                                                                      PID:4628
                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                      2⤵
                                                                                                                                        PID:4428
                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                        2⤵
                                                                                                                                          PID:3304
                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                          2⤵
                                                                                                                                            PID:1556
                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                            2⤵
                                                                                                                                              PID:1656
                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                              2⤵
                                                                                                                                                PID:4264
                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                2⤵
                                                                                                                                                  PID:3164
                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2936
                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3212
                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                      2⤵
                                                                                                                                                        PID:5028
                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4816
                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5092
                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                            2⤵
                                                                                                                                                              PID:748
                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                              2⤵
                                                                                                                                                                PID:4860
                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:4220
                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:4672
                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:4900
                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:4820
                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:4788
                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:4716
                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:4868
                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:4724
                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:4808
                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:2976
                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4436
                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:3132
                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:1312
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Install2.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Install2.exe"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                        PID:1096
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-GK6MA.tmp\Install2.tmp
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-GK6MA.tmp\Install2.tmp" /SL5="$2015C,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install2.exe"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                          PID:2040
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-51A3G.tmp\Ultra.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-51A3G.tmp\Ultra.exe" /S /UID=burnerch1
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Drops file in Drivers directory
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                            PID:772
                                                                                                                                                                                            • C:\Program Files\Windows Photo Viewer\NKTHQTVUKK\ultramediaburner.exe
                                                                                                                                                                                              "C:\Program Files\Windows Photo Viewer\NKTHQTVUKK\ultramediaburner.exe" /VERYSILENT
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                              PID:1520
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-MD19G.tmp\ultramediaburner.tmp
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-MD19G.tmp\ultramediaburner.tmp" /SL5="$7001A,281924,62464,C:\Program Files\Windows Photo Viewer\NKTHQTVUKK\ultramediaburner.exe" /VERYSILENT
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                PID:1456
                                                                                                                                                                                                • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:308
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c3-b5e42-ba5-adc98-f0cd8a8485705\Ruhyharyke.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c3-b5e42-ba5-adc98-f0cd8a8485705\Ruhyharyke.exe"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                              PID:816
                                                                                                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                PID:2028
                                                                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                  PID:1460
                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 2124
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                    PID:3064
                                                                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:1192968 /prefetch:2
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:2256
                                                                                                                                                                                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                                                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:799762 /prefetch:2
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:2504
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\70-ed6a9-d1e-996a9-26679bd8b3c75\Ludamaecaese.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\70-ed6a9-d1e-996a9-26679bd8b3c75\Ludamaecaese.exe"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Modifies system certificate store
                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                  PID:828
                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\d4covnqx.ysq\001.exe & exit
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                    PID:2068
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d4covnqx.ysq\001.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\d4covnqx.ysq\001.exe
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                                                                                                      PID:2228
                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mw1n5ntr.4zd\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                    PID:2716
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mw1n5ntr.4zd\installer.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\mw1n5ntr.4zd\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                      • Modifies system certificate store
                                                                                                                                                                                                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                      PID:2804
                                                                                                                                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\mw1n5ntr.4zd\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\mw1n5ntr.4zd\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1621188484 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                          PID:2396
                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lrpusl3b.zp5\hbggg.exe & exit
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                      PID:2304
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\lrpusl3b.zp5\hbggg.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\lrpusl3b.zp5\hbggg.exe
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                        • Modifies system certificate store
                                                                                                                                                                                                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                                                                                                        PID:2356
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:2436
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:2944
                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lmbvifkh.cqt\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:3056
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\lmbvifkh.cqt\Setup3310.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\lmbvifkh.cqt\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                          • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                                                                                                          PID:2148
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-4K0AF.tmp\Setup3310.tmp
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-4K0AF.tmp\Setup3310.tmp" /SL5="$302A0,138429,56832,C:\Users\Admin\AppData\Local\Temp\lmbvifkh.cqt\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                            PID:2044
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-FJ4L8.tmp\Setup.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-FJ4L8.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                              PID:2252
                                                                                                                                                                                                              • C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe"
                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:2392
                                                                                                                                                                                                                • C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Data Finder\Versium Research\dp81GdX0OrCQ.exe"
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                    PID:2880
                                                                                                                                                                                                                • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:2452
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:2980
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                      PID:3724
                                                                                                                                                                                                                  • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                      PID:2348
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                          PID:3296
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                            taskkill /im RunWW.exe /f
                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                            PID:3404
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                            timeout /t 6
                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                            PID:3236
                                                                                                                                                                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"
                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:616
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\6161456.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\6161456.exe"
                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                            PID:3236
                                                                                                                                                                                                                            • C:\ProgramData\Windows Host\Windows Host.exe
                                                                                                                                                                                                                              "C:\ProgramData\Windows Host\Windows Host.exe"
                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                PID:3460
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\6911929.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\6911929.exe"
                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                PID:3104
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\3026858.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\3026858.exe"
                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                  PID:3616
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\6410029.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\6410029.exe"
                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                    PID:3736
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 1792
                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                      PID:1336
                                                                                                                                                                                                                                • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:2124
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                    "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                      PID:2436
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                    PID:2376
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-3E5KB.tmp\lylal220.tmp
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-3E5KB.tmp\lylal220.tmp" /SL5="$10378,237286,153600,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                      PID:2636
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-11RS1.tmp\4_177039.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-11RS1.tmp\4_177039.exe" /S /UID=lylal220
                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                          PID:2668
                                                                                                                                                                                                                                          • C:\Program Files\Java\ZYTXTMWLTM\irecord.exe
                                                                                                                                                                                                                                            "C:\Program Files\Java\ZYTXTMWLTM\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                              PID:2076
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-TVA7U.tmp\irecord.tmp
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-TVA7U.tmp\irecord.tmp" /SL5="$10450,6139911,56832,C:\Program Files\Java\ZYTXTMWLTM\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                  PID:2984
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\recording\i-record.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                    PID:2436
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ac-39150-042-e67bc-81f9b750d9694\Kuwaxogyxa.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ac-39150-042-e67bc-81f9b750d9694\Kuwaxogyxa.exe"
                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                  PID:2932
                                                                                                                                                                                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                      PID:3340
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\97-c6d5c-d61-5dcb1-85fcbeba3b614\ZHokaekinywy.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\97-c6d5c-d61-5dcb1-85fcbeba3b614\ZHokaekinywy.exe"
                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                      PID:3284
                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hg2yphbu.g2s\001.exe & exit
                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                          PID:4048
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hg2yphbu.g2s\001.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\hg2yphbu.g2s\001.exe
                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                              PID:1960
                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yy3ar3fz.ivh\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                              PID:3080
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\yy3ar3fz.ivh\installer.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\yy3ar3fz.ivh\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                  PID:2288
                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\aoenazpa.5da\hbggg.exe & exit
                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                  PID:2568
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\aoenazpa.5da\hbggg.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\aoenazpa.5da\hbggg.exe
                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                      PID:4124
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                          PID:4172
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                            PID:4712
                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zb54gxls.3xu\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                          PID:4260
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\zb54gxls.3xu\Setup3310.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\zb54gxls.3xu\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                              PID:4324
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-5BCLD.tmp\Setup3310.tmp
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-5BCLD.tmp\Setup3310.tmp" /SL5="$20580,138429,56832,C:\Users\Admin\AppData\Local\Temp\zb54gxls.3xu\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                                  PID:4340
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-RMQR0.tmp\Setup.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-RMQR0.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                      PID:4740
                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ukqg3o3s.s4f\google-game.exe & exit
                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                  PID:4544
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ukqg3o3s.s4f\google-game.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\ukqg3o3s.s4f\google-game.exe
                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                      PID:4592
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setuser
                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                          PID:4648
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fjofd3ie.xnq\flashplayer.exe & exit
                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                        PID:4144
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fjofd3ie.xnq\flashplayer.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\fjofd3ie.xnq\flashplayer.exe
                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                            PID:2848
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nz0zyndo.ycp\setup.exe & exit
                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                            PID:4012
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\nz0zyndo.ycp\setup.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\nz0zyndo.ycp\setup.exe
                                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                                PID:4004
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1ds3ronr.2hq\customer1.exe & exit
                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                PID:4312
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1ds3ronr.2hq\customer1.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\1ds3ronr.2hq\customer1.exe
                                                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                                                    PID:2812
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                                                                        PID:4292
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                        15⤵
                                                                                                                                                                                                                                                                                                          PID:4460
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vvdgndwc.11q\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                        PID:4332
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jkmadaxr.xwt\005.exe & exit
                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                          PID:4448
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jkmadaxr.xwt\005.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jkmadaxr.xwt\005.exe
                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                              PID:2400
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ifoiienk.hh3\toolspab1.exe & exit
                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                              PID:2520
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ifoiienk.hh3\toolspab1.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\ifoiienk.hh3\toolspab1.exe
                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                  PID:2864
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ifoiienk.hh3\toolspab1.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\ifoiienk.hh3\toolspab1.exe
                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                      PID:4604
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xofvby11.uhi\702564a0.exe & exit
                                                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                                                    PID:3140
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\xofvby11.uhi\702564a0.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\xofvby11.uhi\702564a0.exe
                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                        PID:3432
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 124
                                                                                                                                                                                                                                                                                                                          15⤵
                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                          PID:3436
                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0mm4jfah.orz\app.exe /8-2222 & exit
                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                        PID:2760
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0mm4jfah.orz\app.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\0mm4jfah.orz\app.exe /8-2222
                                                                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                                                                            PID:2400
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\0mm4jfah.orz\app.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\0mm4jfah.orz\app.exe" /8-2222
                                                                                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                                                                                PID:1620
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Data Finder\Versium Research\askinstall38.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Data Finder\Versium Research\askinstall38.exe"
                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                      PID:2512
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                          PID:3232
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                            taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                            PID:3312
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\jg7_7wjg.exe"
                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        PID:2856
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 200
                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                          PID:2284
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                        PID:2264
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mv2k3ndq.pgt\google-game.exe & exit
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                  PID:2604
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mv2k3ndq.pgt\google-game.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\mv2k3ndq.pgt\google-game.exe
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                      PID:2648
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setuser
                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                        PID:2872
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ztu4kkc1.gi1\flashplayer.exe & exit
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                      PID:2428
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ztu4kkc1.gi1\flashplayer.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\ztu4kkc1.gi1\flashplayer.exe
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                                                                                                                                                                                                                        PID:2104
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\irecCH4.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\irecCH4.exe"
                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                            PID:4808
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-KMC9H.tmp\irecCH4.tmp
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-KMC9H.tmp\irecCH4.tmp" /SL5="$302FA,140559,56832,C:\Users\Admin\AppData\Local\Temp\irecCH4.exe"
                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                PID:4800
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-0D4CG.tmp\sa__N___FOU____R__45__.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-0D4CG.tmp\sa__N___FOU____R__45__.exe" /S /UID=irecordch4
                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                    PID:5004
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Reference Assemblies\JUGFPPUNQD\irecord.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Reference Assemblies\JUGFPPUNQD\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                        PID:4404
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-0D76Q.tmp\irecord.tmp
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-0D76Q.tmp\irecord.tmp" /SL5="$401A4,6139911,56832,C:\Program Files\Reference Assemblies\JUGFPPUNQD\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                                                                            PID:4412
                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\recording\i-record.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                                                PID:2484
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a-af06d-9dd-079b9-c8cd94dcba185\Xucehynori.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a-af06d-9dd-079b9-c8cd94dcba185\Xucehynori.exe"
                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                              PID:2936
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\22-feedc-54e-07790-439cff3519c56\Lasaesaelaeshi.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\22-feedc-54e-07790-439cff3519c56\Lasaesaelaeshi.exe"
                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                                PID:4468
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jg8_mysu.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\jg8_mysu.exe"
                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                            PID:4904
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 192
                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                                                                                              PID:5044
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                              PID:4660
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4944
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3556
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\JoSetp.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\JoSetp.exe"
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4952
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\4415027.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\4415027.exe"
                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4292
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\6368799.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\6368799.exe"
                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3128
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\3924769.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\3924769.exe"
                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2744
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\liwei.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\liwei.exe"
                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4956
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4980
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\y1.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\y1.exe"
                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5072
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\w5wnjtg0.xj3\setup.exe & exit
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2556
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\w5wnjtg0.xj3\setup.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\w5wnjtg0.xj3\setup.exe
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                                                                                                                                                                                                                                                                PID:2840
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\e1i3502m.5os\customer1.exe & exit
                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2528
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\e1i3502m.5os\customer1.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\e1i3502m.5os\customer1.exe
                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                                                                                                                                                                                                                                                                  PID:2656
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2156
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3344
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bzhbc0vn.h2c\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2180
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oebvtrl5.iaj\005.exe & exit
                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3140
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\oebvtrl5.iaj\005.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\oebvtrl5.iaj\005.exe
                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3216
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jxxhfnf0.fiw\toolspab1.exe & exit
                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4008
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jxxhfnf0.fiw\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jxxhfnf0.fiw\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1548
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jxxhfnf0.fiw\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jxxhfnf0.fiw\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3408
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\50l1qykk.vi0\702564a0.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1976
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\50l1qykk.vi0\702564a0.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\50l1qykk.vi0\702564a0.exe
                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1312
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wlctktqh.iik\app.exe /8-2222 & exit
                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2116
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\wlctktqh.iik\app.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\wlctktqh.iik\app.exe /8-2222
                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2416
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\wlctktqh.iik\app.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\wlctktqh.iik\app.exe" /8-2222
                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2344
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-RQ92C.tmp\LabPicV3.tmp
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-RQ92C.tmp\LabPicV3.tmp" /SL5="$3036A,506127,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                  PID:2684
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-R5NAG.tmp\3316505.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-R5NAG.tmp\3316505.exe" /S /UID=lab214
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3084
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\DVD Maker\VFQAUZGNMY\prolab.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\DVD Maker\VFQAUZGNMY\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4080
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-GUKAJ.tmp\prolab.tmp
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-GUKAJ.tmp\prolab.tmp" /SL5="$80346,575243,216576,C:\Program Files\DVD Maker\VFQAUZGNMY\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3024
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\81-ccad3-9ff-2519c-9417626e4b5c5\Lozhabetozhe.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\81-ccad3-9ff-2519c-9417626e4b5c5\Lozhabetozhe.exe"
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3180
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                                                                                                                                                                                                                                                                                                PID:2648
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\53-c7b8b-56e-7408f-bb337db690770\Bixosycexae.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\53-c7b8b-56e-7408f-bb337db690770\Bixosycexae.exe"
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\el5q4pbh.ehl\001.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\el5q4pbh.ehl\001.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\el5q4pbh.ehl\001.exe
                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iq0nsol3.gak\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\iq0nsol3.gak\installer.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\iq0nsol3.gak\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\flxciikg.e32\hbggg.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\flxciikg.e32\hbggg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\flxciikg.e32\hbggg.exe
                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ikyaiigd.xzf\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ikyaiigd.xzf\Setup3310.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\ikyaiigd.xzf\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3896
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-20KOO.tmp\Setup3310.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-20KOO.tmp\Setup3310.tmp" /SL5="$202F0,138429,56832,C:\Users\Admin\AppData\Local\Temp\ikyaiigd.xzf\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-UPL80.tmp\Setup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-UPL80.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\le1imsft.zkq\google-game.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\le1imsft.zkq\google-game.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\le1imsft.zkq\google-game.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setuser
                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3220
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ukqsx2r5.2al\flashplayer.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ukqsx2r5.2al\flashplayer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\ukqsx2r5.2al\flashplayer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4gtnm3b1.lj4\setup.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4gtnm3b1.lj4\setup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\4gtnm3b1.lj4\setup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vj43gy3n.ffi\customer1.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\vj43gy3n.ffi\customer1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\vj43gy3n.ffi\customer1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lefuduup.5gx\005.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\lefuduup.5gx\005.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\lefuduup.5gx\005.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b5hvbvl2.j0v\toolspab1.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b5hvbvl2.j0v\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\b5hvbvl2.j0v\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b5hvbvl2.j0v\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\b5hvbvl2.j0v\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gksycnx5.y2t\702564a0.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\gksycnx5.y2t\702564a0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\gksycnx5.y2t\702564a0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3320
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ir1qbwir.kcg\app.exe /8-2222 & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ir1qbwir.kcg\app.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\ir1qbwir.kcg\app.exe /8-2222
                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ir1qbwir.kcg\app.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ir1qbwir.kcg\app.exe" /8-2222
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe "-1663403081-3650310981816488026-1233670500-992971432-2040313876-1370872463-357483876"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "LogonUI.exe" /flags:0x0
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\AUDIODG.EXE 0x584
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4112

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/308-103-0x0000000000A60000-0x0000000000A62000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/308-120-0x000000001B0A0000-0x000000001B0B9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/308-118-0x0000000000A66000-0x0000000000A85000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                124KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/308-119-0x0000000000A85000-0x0000000000A86000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/308-100-0x000007FEF19B0000-0x000007FEF2A46000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/616-260-0x00000000002F0000-0x00000000002F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/616-231-0x0000000000300000-0x0000000000301000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/616-247-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/616-257-0x00000000002D0000-0x00000000002F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/616-255-0x000000001B030000-0x000000001B032000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/772-74-0x0000000000BD0000-0x0000000000BD2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/816-102-0x00000000003D0000-0x00000000003D2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/828-111-0x0000000000A50000-0x0000000000A52000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/828-117-0x0000000000A75000-0x0000000000A76000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/828-115-0x0000000000A56000-0x0000000000A75000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                124KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/828-110-0x000007FEF19B0000-0x000007FEF2A46000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                16.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/856-277-0x0000000000B60000-0x0000000000BAB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/856-215-0x0000000000F60000-0x0000000000FD0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/856-214-0x0000000000A70000-0x0000000000ABB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/856-279-0x00000000010D0000-0x0000000001140000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1096-59-0x0000000075281000-0x0000000075283000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1096-60-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                172KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1456-87-0x0000000073F01000-0x0000000073F03000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1456-101-0x0000000000240000-0x0000000000241000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1520-78-0x0000000000400000-0x0000000000416000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2040-69-0x0000000000240000-0x0000000000241000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-177-0x0000000003910000-0x0000000003967000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                348KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-186-0x00000000039A0000-0x00000000039A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-181-0x0000000003910000-0x0000000003967000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                348KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-182-0x0000000003910000-0x0000000003967000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                348KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-176-0x0000000003820000-0x0000000003821000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-183-0x0000000003970000-0x0000000003971000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-175-0x0000000001F90000-0x0000000001F91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-184-0x0000000003980000-0x0000000003981000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-185-0x0000000003990000-0x0000000003991000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-174-0x0000000001F80000-0x0000000001F81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-173-0x00000000003E0000-0x00000000003E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-178-0x0000000003910000-0x0000000003967000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                348KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-179-0x0000000003910000-0x0000000003967000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                348KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-180-0x0000000003910000-0x0000000003967000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                348KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-188-0x00000000039C0000-0x00000000039C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-189-0x00000000039D0000-0x00000000039D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-190-0x00000000039E0000-0x00000000039E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-170-0x0000000001F40000-0x0000000001F7C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                240KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-187-0x00000000039B0000-0x00000000039B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2104-261-0x0000000001030000-0x0000000001031000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2148-161-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2228-128-0x0000000000270000-0x0000000000282000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2228-127-0x0000000000240000-0x0000000000250000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2264-234-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                436KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2284-272-0x0000000000580000-0x0000000000581000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2348-304-0x0000000000220000-0x00000000002B7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                604KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2348-305-0x0000000000400000-0x00000000004A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                664KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2376-238-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                176KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2392-224-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2392-265-0x00000000047A0000-0x00000000047A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2436-276-0x0000000000A30000-0x0000000000A8C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                368KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2436-275-0x0000000000890000-0x0000000000991000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2436-274-0x0000000010000000-0x0000000010002000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2452-249-0x0000000001040000-0x000000000169F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2532-148-0x000007FEFB6B1000-0x000007FEFB6B3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2636-254-0x0000000000240000-0x0000000000241000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2668-290-0x0000000000BF0000-0x0000000000BF2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2684-253-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2804-134-0x0000000000750000-0x00000000007ED000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                628KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2856-258-0x0000000000400000-0x000000000065D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                2.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2872-211-0x0000000010000000-0x0000000010002000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2872-213-0x0000000001E80000-0x0000000001EDC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                368KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2872-212-0x0000000001D10000-0x0000000001E11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3020-217-0x00000000003A0000-0x0000000000410000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                448KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3064-273-0x0000000001E30000-0x0000000001E31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3084-291-0x0000000002010000-0x0000000002012000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3104-301-0x00000000004E0000-0x000000000051C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                240KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3104-306-0x00000000048E0000-0x00000000048E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3104-286-0x0000000000480000-0x0000000000481000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3104-283-0x0000000000E50000-0x0000000000E51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3104-302-0x0000000000490000-0x0000000000491000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3216-294-0x0000000000300000-0x0000000000312000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3216-292-0x0000000000240000-0x0000000000250000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3236-296-0x0000000000400000-0x0000000000401000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3236-298-0x00000000048D0000-0x00000000048D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3236-293-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3236-297-0x0000000000410000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3236-299-0x0000000000420000-0x0000000000421000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3460-307-0x0000000000880000-0x0000000000881000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3460-310-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download