Overview

overview

10

Static

static

4A53B92B00...2F.exe

windows7_x64

8

4A53B92B00...2F.exe

windows10_x64

10

Analysis

  • max time kernel
    41s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    31/05/2021, 23:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4A53B92B00FC052FC1B90D7130515E2F.exe
  • Size 4.2MB
  • Sample210531-8mrdtcc2ea
  • SHA256 a7380ab000584685bb2bba25704046915d0bdaaf3a809bf80c84bbe27f765e49
  • MD5 SHA1 SHA512
Score
10/10
danabotgluptebametasploitredlinesmokeloadervidar331_5_ruzki706servjasonaspackv2backdoorbankerdiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

  • vidar

Version

  • 38.9

Botnet

  • 706

C2

  • https://HAL9THapi.faceit.compavel23puef

Attributes
  • profile_id

    706

Extracted

Family

  • redline

Botnet

  • 31_5_ruzki

C2

  • quropaloar.xyz:80

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://ppcspb.com/upload/

  • http://mebbing.com/upload/

  • http://twcamel.com/upload/

  • http://howdycash.com/upload/

  • http://lahuertasonora.com/upload/

  • http://kpotiques.com/upload/

rc4.i32
rc4.i32

Extracted

Family

  • redline

C2

  • 87.251.71.221:80

Extracted

Family

  • redline

Botnet

  • ServJason

C2

  • ergerge.top:80

Extracted

Family

  • metasploit

Version

  • windows/single_exec

Extracted

Family

  • danabot

Version

  • 1827

Botnet

  • 3

C2

  • 184.95.51.183:443

  • 184.95.51.175:443

  • 192.210.198.12:443

  • 184.95.51.180:443

Attributes
  • embedded_hash

    AEF96B4D339B580ABB737F203C2D0F52

rsa_pubkey.plain
rsa_pubkey.plain

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Vidar Stealer 2 IoCs
    stealer
  • ASPack v2.12-2.42 8 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 49 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 17 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
    evasion
  • Kills process with taskkill 7 IoCs
    evasion
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 6 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
      PID:2796
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2776
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2672
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
        1⤵
          PID:2488
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2468
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
          1⤵
            PID:1904
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s SENS
            1⤵
              PID:1412
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
              1⤵
                PID:1356
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                1⤵
                  PID:1268
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                  1⤵
                    PID:1080
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                      PID:936
                      • C:\Users\Admin\AppData\Roaming\ffatrig
                        C:\Users\Admin\AppData\Roaming\ffatrig
                        2⤵
                          PID:9508
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:344
                        • C:\Users\Admin\AppData\Local\Temp\4A53B92B00FC052FC1B90D7130515E2F.exe
                          "C:\Users\Admin\AppData\Local\Temp\4A53B92B00FC052FC1B90D7130515E2F.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3952
                          • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                            "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1528
                            • C:\Users\Admin\AppData\Local\Temp\7zS8F551F34\setup_install.exe
                              "C:\Users\Admin\AppData\Local\Temp\7zS8F551F34\setup_install.exe"
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:2436
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c metina_1.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1248
                                • C:\Users\Admin\AppData\Local\Temp\7zS8F551F34\metina_1.exe
                                  metina_1.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Checks computer location settings
                                  • Modifies registry class
                                  PID:3524
                                  • C:\Windows\SysWOW64\rUNdlL32.eXe
                                    "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                    6⤵
                                    • Loads dropped DLL
                                    PID:4244
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c metina_2.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2764
                                • C:\Users\Admin\AppData\Local\Temp\7zS8F551F34\metina_2.exe
                                  metina_2.exe
                                  5⤵
                                  • Executes dropped EXE
                                  PID:3896
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c metina_3.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2244
                                • C:\Users\Admin\AppData\Local\Temp\7zS8F551F34\metina_3.exe
                                  metina_3.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks processor information in registry
                                  PID:3788
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /im metina_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS8F551F34\metina_3.exe" & del C:\ProgramData\*.dll & exit
                                    6⤵
                                      PID:636
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /im metina_3.exe /f
                                        7⤵
                                        • Kills process with taskkill
                                        PID:5432
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout /t 6
                                        7⤵
                                        • Delays execution with timeout.exe
                                        PID:4644
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c metina_5.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1128
                                  • C:\Users\Admin\AppData\Local\Temp\7zS8F551F34\metina_5.exe
                                    metina_5.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:3952
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c metina_4.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3256
                                  • C:\Users\Admin\AppData\Local\Temp\7zS8F551F34\metina_4.exe
                                    metina_4.exe
                                    5⤵
                                    • Executes dropped EXE
                                    PID:3928
                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      6⤵
                                      • Executes dropped EXE
                                      PID:4148
                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4708
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c metina_7.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2144
                                  • C:\Users\Admin\AppData\Local\Temp\7zS8F551F34\metina_7.exe
                                    metina_7.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:508
                                    • C:\Users\Admin\Documents\https___cdn.discordapp.com_attachments_846372010271703082_848137134849130516_Setup2.exe.exe
                                      "C:\Users\Admin\Documents\https___cdn.discordapp.com_attachments_846372010271703082_848137134849130516_Setup2.exe.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      PID:4676
                                      • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                        "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:4348
                                      • C:\Program Files (x86)\Company\NewProduct\lij.exe
                                        "C:\Program Files (x86)\Company\NewProduct\lij.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:2132
                                      • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Drops file in Program Files directory
                                        PID:1528
                                    • C:\Users\Admin\Documents\http___bandshoo.info_app.exe.exe
                                      "C:\Users\Admin\Documents\http___bandshoo.info_app.exe.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      PID:4820
                                      • C:\Users\Admin\Documents\http___bandshoo.info_app.exe.exe
                                        "C:\Users\Admin\Documents\http___bandshoo.info_app.exe.exe"
                                        7⤵
                                          PID:5148
                                      • C:\Users\Admin\Documents\http___212.192.241.136_files_file1.exe.exe
                                        "C:\Users\Admin\Documents\http___212.192.241.136_files_file1.exe.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        PID:4864
                                      • C:\Users\Admin\Documents\https___arelchem.com_img_gallery_img_AwSetp.exe.exe
                                        "C:\Users\Admin\Documents\https___arelchem.com_img_gallery_img_AwSetp.exe.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4948
                                        • C:\Users\Admin\AppData\Roaming\4355716.exe
                                          "C:\Users\Admin\AppData\Roaming\4355716.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:5064
                                        • C:\Users\Admin\AppData\Roaming\6336531.exe
                                          "C:\Users\Admin\AppData\Roaming\6336531.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: SetClipboardViewer
                                          PID:4092
                                        • C:\Users\Admin\AppData\Roaming\7313730.exe
                                          "C:\Users\Admin\AppData\Roaming\7313730.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          PID:4168
                                          • C:\Users\Admin\AppData\Roaming\7313730.exe
                                            "{path}"
                                            8⤵
                                              PID:4400
                                            • C:\Users\Admin\AppData\Roaming\7313730.exe
                                              "{path}"
                                              8⤵
                                                PID:4792
                                          • C:\Users\Admin\Documents\https___014a2835-e6dd-43e5-833c-a25b69a6bfd4.s3.amazonaws.com_BBQbrowser.exe.exe
                                            "C:\Users\Admin\Documents\https___014a2835-e6dd-43e5-833c-a25b69a6bfd4.s3.amazonaws.com_BBQbrowser.exe.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4996
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                              C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
                                              7⤵
                                                PID:1552
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
                                                7⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:8
                                            • C:\Users\Admin\Documents\https___cdn.discordapp.com_attachments_826897158568804390_839908231831617556_jooyu.exe.exe
                                              "C:\Users\Admin\Documents\https___cdn.discordapp.com_attachments_826897158568804390_839908231831617556_jooyu.exe.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              PID:4668
                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                7⤵
                                                • Executes dropped EXE
                                                PID:4576
                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                7⤵
                                                • Executes dropped EXE
                                                PID:4392
                                            • C:\Users\Admin\Documents\http___212.192.241.136_files_file2.exe.exe
                                              "C:\Users\Admin\Documents\http___212.192.241.136_files_file2.exe.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5060
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
                                                7⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5012
                                            • C:\Users\Admin\Documents\http___212.192.241.136_files_file3.exe.exe
                                              "C:\Users\Admin\Documents\http___212.192.241.136_files_file3.exe.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3508
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
                                                7⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4812
                                            • C:\Users\Admin\Documents\https___2no.co_2YW9u6.exe
                                              "C:\Users\Admin\Documents\https___2no.co_2YW9u6.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              PID:4312
                                              • C:\Windows\SysWOW64\rundll32.exe
                                                C:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\HT15CC~1.DLL,Z C:\Users\Admin\DOCUME~1\HT15CC~1.EXE
                                                7⤵
                                                • Loads dropped DLL
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1804
                                                • C:\Windows\SysWOW64\RUNDLL32.EXE
                                                  C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\HT15CC~1.DLL,jTtSfDajBbQ=
                                                  8⤵
                                                  • Blocklisted process makes network request
                                                  • Loads dropped DLL
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4300
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpC20D.tmp.ps1"
                                                    9⤵
                                                      PID:5240
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp4C4E.tmp.ps1"
                                                      9⤵
                                                        PID:7976
                                                        • C:\Windows\SysWOW64\nslookup.exe
                                                          "C:\Windows\system32\nslookup.exe" -type=any localhost
                                                          10⤵
                                                            PID:5912
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
                                                          9⤵
                                                            PID:5684
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
                                                            9⤵
                                                              PID:9612
                                                      • C:\Users\Admin\Documents\https___jom.diregame.live_userf_2201_google-game.exe.exe
                                                        "C:\Users\Admin\Documents\https___jom.diregame.live_userf_2201_google-game.exe.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Checks computer location settings
                                                        • Modifies registry class
                                                        PID:1468
                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                          7⤵
                                                          • Loads dropped DLL
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2664
                                                      • C:\Users\Admin\Documents\http___212.192.241.136_files_file5.exe.exe
                                                        "C:\Users\Admin\Documents\http___212.192.241.136_files_file5.exe.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3700
                                                      • C:\Users\Admin\Documents\http___212.192.241.136_files_file4.exe.exe
                                                        "C:\Users\Admin\Documents\http___212.192.241.136_files_file4.exe.exe"
                                                        6⤵
                                                          PID:7488
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c timeout 1
                                                            7⤵
                                                              PID:7840
                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                timeout 1
                                                                8⤵
                                                                • Delays execution with timeout.exe
                                                                PID:8048
                                                            • C:\Users\Admin\Documents\http___212.192.241.136_files_file4.exe.exe
                                                              "C:\Users\Admin\Documents\http___212.192.241.136_files_file4.exe.exe"
                                                              7⤵
                                                                PID:7532
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 7488 -s 1416
                                                                7⤵
                                                                • Program crash
                                                                PID:8068
                                                            • C:\Users\Admin\Documents\http___212.192.241.136_files_file6.exe.exe
                                                              "C:\Users\Admin\Documents\http___212.192.241.136_files_file6.exe.exe"
                                                              6⤵
                                                                PID:9516
                                                              • C:\Users\Admin\Documents\http___212.192.241.136_files_file8.exe.exe
                                                                "C:\Users\Admin\Documents\http___212.192.241.136_files_file8.exe.exe"
                                                                6⤵
                                                                  PID:1428
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im "metina_7.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS8F551F34\metina_7.exe" & exit
                                                                  6⤵
                                                                    PID:8404
                                                                    • C:\Windows\system32\taskkill.exe
                                                                      taskkill /im "metina_7.exe" /f
                                                                      7⤵
                                                                      • Kills process with taskkill
                                                                      PID:4256
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c metina_6.exe
                                                                4⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3932
                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8F551F34\metina_6.exe
                                                                  metina_6.exe
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1656
                                                                  • C:\Users\Admin\AppData\Roaming\3874154.exe
                                                                    "C:\Users\Admin\AppData\Roaming\3874154.exe"
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:4396
                                                                  • C:\Users\Admin\AppData\Roaming\2259845.exe
                                                                    "C:\Users\Admin\AppData\Roaming\2259845.exe"
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    • Adds Run key to start application
                                                                    PID:4496
                                                                    • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      PID:5020
                                                                  • C:\Users\Admin\AppData\Roaming\4964716.exe
                                                                    "C:\Users\Admin\AppData\Roaming\4964716.exe"
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    PID:4652
                                                                    • C:\Users\Admin\AppData\Roaming\4964716.exe
                                                                      "{path}"
                                                                      7⤵
                                                                        PID:6372
                                                                      • C:\Users\Admin\AppData\Roaming\4964716.exe
                                                                        "{path}"
                                                                        7⤵
                                                                          PID:6236
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c metina_8.exe
                                                                    4⤵
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1584
                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8F551F34\metina_8.exe
                                                                      metina_8.exe
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2816
                                                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe"
                                                                        6⤵
                                                                        • Executes dropped EXE
                                                                        • Checks computer location settings
                                                                        • Modifies registry class
                                                                        PID:808
                                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setpwd
                                                                          7⤵
                                                                            PID:4628
                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\NMemo2Setp.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\NMemo2Setp.exe"
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Checks SCSI registry key(s)
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious behavior: MapViewOfSection
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3896
                                                                          • C:\Users\Admin\AppData\Roaming\1914191.exe
                                                                            "C:\Users\Admin\AppData\Roaming\1914191.exe"
                                                                            7⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious behavior: SetClipboardViewer
                                                                            PID:5584
                                                                          • C:\Users\Admin\AppData\Roaming\8020950.exe
                                                                            "C:\Users\Admin\AppData\Roaming\8020950.exe"
                                                                            7⤵
                                                                            • Executes dropped EXE
                                                                            PID:5692
                                                                            • C:\Users\Admin\AppData\Roaming\8020950.exe
                                                                              "{path}"
                                                                              8⤵
                                                                                PID:2284
                                                                            • C:\Users\Admin\AppData\Roaming\5926773.exe
                                                                              "C:\Users\Admin\AppData\Roaming\5926773.exe"
                                                                              7⤵
                                                                                PID:5492
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c metina_9.exe
                                                                          4⤵
                                                                            PID:3804
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c metina_10.exe
                                                                            4⤵
                                                                              PID:1320
                                                                        • C:\Users\Admin\AppData\Local\Temp\is-HL2DE.tmp\metina_5.tmp
                                                                          "C:\Users\Admin\AppData\Local\Temp\is-HL2DE.tmp\metina_5.tmp" /SL5="$4002E,290022,206336,C:\Users\Admin\AppData\Local\Temp\7zS8F551F34\metina_5.exe"
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:3876
                                                                          • C:\Users\Admin\AppData\Local\Temp\is-IQVTS.tmp\djhdfu_____________.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\is-IQVTS.tmp\djhdfu_____________.exe" /S /UID=burnerch1
                                                                            3⤵
                                                                            • Drops file in Drivers directory
                                                                            • Executes dropped EXE
                                                                            • Adds Run key to start application
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4564
                                                                            • C:\Program Files\Windows Portable Devices\IGXTXGZHGJ\ultramediaburner.exe
                                                                              "C:\Program Files\Windows Portable Devices\IGXTXGZHGJ\ultramediaburner.exe" /VERYSILENT
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              PID:5152
                                                                              • C:\Users\Admin\AppData\Local\Temp\is-2Q5MM.tmp\ultramediaburner.tmp
                                                                                "C:\Users\Admin\AppData\Local\Temp\is-2Q5MM.tmp\ultramediaburner.tmp" /SL5="$4028C,281924,62464,C:\Program Files\Windows Portable Devices\IGXTXGZHGJ\ultramediaburner.exe" /VERYSILENT
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Program Files directory
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                PID:5284
                                                                                • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                  "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:5540
                                                                            • C:\Users\Admin\AppData\Local\Temp\41-d7aba-6b4-8669d-d14df4c89c911\Pydiwohovi.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\41-d7aba-6b4-8669d-d14df4c89c911\Pydiwohovi.exe"
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              PID:5356
                                                                            • C:\Users\Admin\AppData\Local\Temp\02-37551-eff-cd9bd-a4593402026db\Bivogalody.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\02-37551-eff-cd9bd-a4593402026db\Bivogalody.exe"
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              PID:5456
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fgslxcwt.eus\EU1.exe & exit
                                                                                5⤵
                                                                                  PID:5548
                                                                                  • C:\Users\Admin\AppData\Local\Temp\fgslxcwt.eus\EU1.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\fgslxcwt.eus\EU1.exe
                                                                                    6⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:4700
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\JUHY9046DQDAM9RY7KBGBIE6.exe"
                                                                                      7⤵
                                                                                        PID:5520
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\RWI1BKG30CSPLFO64UTJXRAD.exe"
                                                                                        7⤵
                                                                                          PID:5004
                                                                                          • C:\Users\Admin\AppData\Roaming\RWI1BKG30CSPLFO64UTJXRAD.exe
                                                                                            "C:\Users\Admin\AppData\Roaming\RWI1BKG30CSPLFO64UTJXRAD.exe"
                                                                                            8⤵
                                                                                              PID:6236
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im "EU1.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\fgslxcwt.eus\EU1.exe" & exit
                                                                                            7⤵
                                                                                              PID:6584
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /im "EU1.exe" /f
                                                                                                8⤵
                                                                                                • Kills process with taskkill
                                                                                                PID:6256
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jkvus1fu.odw\001.exe & exit
                                                                                          5⤵
                                                                                            PID:192
                                                                                            • C:\Users\Admin\AppData\Local\Temp\jkvus1fu.odw\001.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\jkvus1fu.odw\001.exe
                                                                                              6⤵
                                                                                                PID:6132
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tb1ncwkg.jub\ebook.exe & exit
                                                                                              5⤵
                                                                                                PID:5808
                                                                                                • C:\Users\Admin\AppData\Local\Temp\tb1ncwkg.jub\ebook.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\tb1ncwkg.jub\ebook.exe
                                                                                                  6⤵
                                                                                                    PID:6384
                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\tb1ncwkg.jub\EBOOKE~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\tb1ncwkg.jub\ebook.exe
                                                                                                      7⤵
                                                                                                        PID:6328
                                                                                                        • C:\Windows\SysWOW64\RUNDLL32.EXE
                                                                                                          C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\tb1ncwkg.jub\EBOOKE~1.DLL,WjogfI14
                                                                                                          8⤵
                                                                                                            PID:6484
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x3upg1p3.bcj\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                      5⤵
                                                                                                        PID:6692
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\x3upg1p3.bcj\installer.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\x3upg1p3.bcj\installer.exe /qn CAMPAIGN="654"
                                                                                                          6⤵
                                                                                                            PID:6892
                                                                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                                                                              "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\x3upg1p3.bcj\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\x3upg1p3.bcj\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1622242586 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                              7⤵
                                                                                                                PID:6340
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lbr2dksa.3lx\md1_1eaf.exe & exit
                                                                                                            5⤵
                                                                                                              PID:7044
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\lbr2dksa.3lx\md1_1eaf.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\lbr2dksa.3lx\md1_1eaf.exe
                                                                                                                6⤵
                                                                                                                  PID:6292
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rm2ry01x.5lz\gaoou.exe & exit
                                                                                                                5⤵
                                                                                                                  PID:6784
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\rm2ry01x.5lz\gaoou.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\rm2ry01x.5lz\gaoou.exe
                                                                                                                    6⤵
                                                                                                                      PID:6988
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                        7⤵
                                                                                                                          PID:5608
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                          7⤵
                                                                                                                            PID:5808
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lobegsig.nfb\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                        5⤵
                                                                                                                          PID:6792
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\lobegsig.nfb\Setup3310.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\lobegsig.nfb\Setup3310.exe /Verysilent /subid=623
                                                                                                                            6⤵
                                                                                                                              PID:7128
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-LF36P.tmp\Setup3310.tmp
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-LF36P.tmp\Setup3310.tmp" /SL5="$2036C,138429,56832,C:\Users\Admin\AppData\Local\Temp\lobegsig.nfb\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                7⤵
                                                                                                                                  PID:6028
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-I3RDV.tmp\Setup.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-I3RDV.tmp\Setup.exe" /Verysilent
                                                                                                                                    8⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:5492
                                                                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                                                                                      9⤵
                                                                                                                                        PID:6872
                                                                                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe
                                                                                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"
                                                                                                                                        9⤵
                                                                                                                                          PID:6196
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\3671042.exe
                                                                                                                                            "C:\Users\Admin\AppData\Roaming\3671042.exe"
                                                                                                                                            10⤵
                                                                                                                                              PID:5568
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5568 -s 1916
                                                                                                                                                11⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:8684
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\5372298.exe
                                                                                                                                              "C:\Users\Admin\AppData\Roaming\5372298.exe"
                                                                                                                                              10⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:6132
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\2781416.exe
                                                                                                                                              "C:\Users\Admin\AppData\Roaming\2781416.exe"
                                                                                                                                              10⤵
                                                                                                                                                PID:6080
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\2781416.exe
                                                                                                                                                  "{path}"
                                                                                                                                                  11⤵
                                                                                                                                                    PID:8000
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\6907987.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\6907987.exe"
                                                                                                                                                  10⤵
                                                                                                                                                    PID:6752
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6752 -s 1892
                                                                                                                                                      11⤵
                                                                                                                                                      • Program crash
                                                                                                                                                      PID:4788
                                                                                                                                                • C:\Program Files (x86)\Data Finder\Versium Research\003.exe
                                                                                                                                                  "C:\Program Files (x86)\Data Finder\Versium Research\003.exe"
                                                                                                                                                  9⤵
                                                                                                                                                    PID:6708
                                                                                                                                                  • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                                                                                                                    "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                    9⤵
                                                                                                                                                      PID:6760
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-0DKR3.tmp\lylal220.tmp
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-0DKR3.tmp\lylal220.tmp" /SL5="$30482,140518,56832,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                        10⤵
                                                                                                                                                          PID:1536
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-K0Q04.tmp\___________RUb__________y.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-K0Q04.tmp\___________RUb__________y.exe" /S /UID=lylal220
                                                                                                                                                            11⤵
                                                                                                                                                              PID:3936
                                                                                                                                                              • C:\Program Files\Google\GXFLQXDXSF\irecord.exe
                                                                                                                                                                "C:\Program Files\Google\GXFLQXDXSF\irecord.exe" /VERYSILENT
                                                                                                                                                                12⤵
                                                                                                                                                                  PID:6268
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-0C4LO.tmp\irecord.tmp
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-0C4LO.tmp\irecord.tmp" /SL5="$30496,6139911,56832,C:\Program Files\Google\GXFLQXDXSF\irecord.exe" /VERYSILENT
                                                                                                                                                                    13⤵
                                                                                                                                                                      PID:7804
                                                                                                                                                                      • C:\Program Files (x86)\recording\i-record.exe
                                                                                                                                                                        "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                        14⤵
                                                                                                                                                                          PID:6824
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\a0-74594-441-ac1ae-df2674d704f41\Pugiluseso.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\a0-74594-441-ac1ae-df2674d704f41\Pugiluseso.exe"
                                                                                                                                                                      12⤵
                                                                                                                                                                        PID:7620
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39-712ce-72e-01c88-a05a1bd8a8def\Lidoletudu.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39-712ce-72e-01c88-a05a1bd8a8def\Lidoletudu.exe"
                                                                                                                                                                        12⤵
                                                                                                                                                                          PID:4848
                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\abripeng.lil\001.exe & exit
                                                                                                                                                                            13⤵
                                                                                                                                                                              PID:8240
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\abripeng.lil\001.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\abripeng.lil\001.exe
                                                                                                                                                                                14⤵
                                                                                                                                                                                  PID:8452
                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\our5bk3l.ebc\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                13⤵
                                                                                                                                                                                  PID:9696
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\our5bk3l.ebc\installer.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\our5bk3l.ebc\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                    14⤵
                                                                                                                                                                                      PID:10056
                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cesupjze.y4x\gaoou.exe & exit
                                                                                                                                                                                    13⤵
                                                                                                                                                                                      PID:5680
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\cesupjze.y4x\gaoou.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\cesupjze.y4x\gaoou.exe
                                                                                                                                                                                        14⤵
                                                                                                                                                                                          PID:8688
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                            15⤵
                                                                                                                                                                                              PID:3700
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                              15⤵
                                                                                                                                                                                                PID:7008
                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ph10ivwx.3kn\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                            13⤵
                                                                                                                                                                                              PID:9128
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ph10ivwx.3kn\Setup3310.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\ph10ivwx.3kn\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                                14⤵
                                                                                                                                                                                                  PID:9988
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-KKUM4.tmp\Setup3310.tmp
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-KKUM4.tmp\Setup3310.tmp" /SL5="$60476,138429,56832,C:\Users\Admin\AppData\Local\Temp\ph10ivwx.3kn\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                      PID:10144
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-0FV14.tmp\Setup.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-0FV14.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                          PID:5136
                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\j40fda15.h14\google-game.exe & exit
                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                      PID:5972
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\j40fda15.h14\google-game.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\j40fda15.h14\google-game.exe
                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                          PID:5244
                                                                                                                                                                                                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                              PID:9560
                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 9560 -s 620
                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                PID:6840
                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iz00ycwy.ttx\005.exe & exit
                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                            PID:9524
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\iz00ycwy.ttx\005.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\iz00ycwy.ttx\005.exe
                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                PID:6604
                                                                                                                                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                        PID:6328
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-09CJ2.tmp\LabPicV3.tmp
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-09CJ2.tmp\LabPicV3.tmp" /SL5="$3049A,140559,56832,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                            PID:4424
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-LK9OG.tmp\___________23.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-LK9OG.tmp\___________23.exe" /S /UID=lab214
                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                PID:4828
                                                                                                                                                                                                                • C:\Program Files\Google\GXFLQXDXSF\prolab.exe
                                                                                                                                                                                                                  "C:\Program Files\Google\GXFLQXDXSF\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                    PID:7932
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-UG6CQ.tmp\prolab.tmp
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-UG6CQ.tmp\prolab.tmp" /SL5="$8021C,575243,216576,C:\Program Files\Google\GXFLQXDXSF\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                        PID:7976
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\33-3a9cf-ba6-01db7-d86ba38749148\Waesysuviwi.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\33-3a9cf-ba6-01db7-d86ba38749148\Waesysuviwi.exe"
                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                        PID:3876
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\92-077d6-77f-9e394-f9d154351c44d\Syfenishega.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\92-077d6-77f-9e394-f9d154351c44d\Syfenishega.exe"
                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                          PID:7436
                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0rclc0k5.qws\001.exe & exit
                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                              PID:4872
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\0rclc0k5.qws\001.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\0rclc0k5.qws\001.exe
                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                  PID:6588
                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2htt5z4k.30m\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                  PID:9080
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2htt5z4k.30m\installer.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2htt5z4k.30m\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                      PID:9420
                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5o5p3ek5.q0b\gaoou.exe & exit
                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                      PID:9808
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\5o5p3ek5.q0b\gaoou.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\5o5p3ek5.q0b\gaoou.exe
                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                          PID:10028
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                              PID:8104
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                PID:9880
                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\13rdnss2.fzf\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                              PID:7968
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\13rdnss2.fzf\Setup3310.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\13rdnss2.fzf\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                  PID:8680
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-48P1T.tmp\Setup3310.tmp
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-48P1T.tmp\Setup3310.tmp" /SL5="$403EE,138429,56832,C:\Users\Admin\AppData\Local\Temp\13rdnss2.fzf\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                      PID:7272
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-R75VN.tmp\Setup.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-R75VN.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                          PID:5932
                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tfzxjzzs.dqd\google-game.exe & exit
                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                      PID:10232
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tfzxjzzs.dqd\google-game.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\tfzxjzzs.dqd\google-game.exe
                                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                                          PID:5836
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                                                                              PID:9316
                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\f14lsnsd.fz0\005.exe & exit
                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                            PID:6476
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\f14lsnsd.fz0\005.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\f14lsnsd.fz0\005.exe
                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                PID:4744
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                        PID:6812
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                            PID:6164
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                            PID:6956
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                PID:1388
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                  PID:5672
                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ewvomwgc.3lo\google-game.exe & exit
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:6976
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ewvomwgc.3lo\google-game.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\ewvomwgc.3lo\google-game.exe
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:188
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                                "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                  PID:6872
                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3swtr2hb.huv\SetupWW.exe & exit
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:6372
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3swtr2hb.huv\SetupWW.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3swtr2hb.huv\SetupWW.exe
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:5124
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im SetupWW.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\3swtr2hb.huv\SetupWW.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                        PID:7304
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                          taskkill /im SetupWW.exe /f
                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                          PID:7444
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                          timeout /t 6
                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                          PID:7416
                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jwy135s0.3gb\005.exe & exit
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:5608
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jwy135s0.3gb\005.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jwy135s0.3gb\005.exe
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                          PID:5768
                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zqxynx14.2be\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:8608
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\zqxynx14.2be\installer.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\zqxynx14.2be\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:6960
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\zqxynx14.2be\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\zqxynx14.2be\ EXE_CMD_LINE="/forcecleanup /wintime 1622242586 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                  PID:4248
                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xnjmlzsk.efz\app.exe /8-2222 & exit
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:6068
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\xnjmlzsk.efz\app.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\xnjmlzsk.efz\app.exe /8-2222
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:3864
                                                                                                                                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                          PID:3740
                                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                            PID:1464
                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                          PID:4804
                                                                                                                                                                                                                                                                        • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:5852
                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:6524
                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:6352
                                                                                                                                                                                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:6776
                                                                                                                                                                                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 605D6C67856D9D46B0837351884C358F C
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:4776
                                                                                                                                                                                                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding EC11032052E62F3CCBB138B68B9B808B
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:4416
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                                          PID:6508
                                                                                                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding B4107A88663E227AA184CB54F32B0171 E Global\MSI0000
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:3164
                                                                                                                                                                                                                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding FC67DA82D71C590278BC0BF3896CA9AD C
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:8840
                                                                                                                                                                                                                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding F2C0A923D1311769B4651D0D89B71D85
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:8920
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                PID:10216
                                                                                                                                                                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding 9162D8515E8499D9DDAB8881C03882D4 E Global\MSI0000
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:7044
                                                                                                                                                                                                                                                                                            • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:6656
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                PID:4628
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4D46.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\4D46.exe
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:8144
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im 4D46.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\4D46.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:7148
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                        taskkill /im 4D46.exe /f
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                        PID:8480
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                        timeout /t 6
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                        PID:8672
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6284.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\6284.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:8564
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6284.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\6284.exe
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:8312
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6A27.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\6A27.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:9100
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7831.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7831.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:3968
                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:8496
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:2124
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9148.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\9148.exe
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:4448
                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:8860
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:6544
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:9416
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:4244
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:7764

                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                memory/8-292-0x0000000000400000-0x000000000041C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/8-316-0x0000000005540000-0x0000000005B46000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/344-365-0x000001F8C3180000-0x000001F8C31F0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/508-185-0x00000000007A0000-0x00000000007A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/508-169-0x0000000000160000-0x0000000000161000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1356-343-0x000001CFD9800000-0x000001CFD9870000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1356-342-0x000001CFD95A0000-0x000001CFD95EB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1464-363-0x00000277299F0000-0x0000027729A60000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1656-182-0x0000000000810000-0x0000000000811000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1656-189-0x0000000000840000-0x0000000000841000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1656-187-0x0000000000820000-0x0000000000840000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1656-177-0x00000000002F0000-0x00000000002F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1656-188-0x000000001AE80000-0x000000001AE82000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1804-357-0x0000000000D30000-0x0000000000D31000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/1804-351-0x00000000052B1000-0x0000000005910000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2436-133-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2436-138-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2436-137-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2436-136-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2436-135-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2436-134-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2436-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2436-131-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2488-369-0x000001882B4B0000-0x000001882B520000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2664-340-0x0000000004DDE000-0x0000000004EDF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2664-345-0x0000000004F40000-0x0000000004F9C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2672-356-0x0000020467070000-0x00000204670E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2756-296-0x0000000002900000-0x0000000002916000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/2796-348-0x000001C58DC10000-0x000001C58DC80000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3508-264-0x00000000008A0000-0x00000000008A1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3508-269-0x00000000051A0000-0x00000000051A1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3700-290-0x0000000005760000-0x0000000005761000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3700-304-0x00000000059C0000-0x00000000059C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3700-284-0x0000000005710000-0x0000000005711000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3700-293-0x00000000017D0000-0x00000000017D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3700-283-0x0000000003150000-0x0000000003151000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3700-282-0x0000000005D80000-0x0000000005D81000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3700-286-0x0000000005770000-0x0000000005771000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3700-280-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3740-350-0x000002577F4E0000-0x000002577F550000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3788-275-0x0000000000400000-0x00000000004B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3788-274-0x0000000002140000-0x00000000021D7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3876-186-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3896-273-0x0000000000400000-0x0000000000458000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3896-272-0x0000000000460000-0x000000000050E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3896-322-0x000000001AE20000-0x000000001AE22000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/3952-170-0x0000000000400000-0x0000000000439000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4092-331-0x0000000005010000-0x0000000005011000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4168-335-0x0000000005350000-0x000000000584E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4312-332-0x0000000002D80000-0x0000000003487000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4312-334-0x0000000000400000-0x0000000000B14000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4312-336-0x0000000002720000-0x0000000002721000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4348-319-0x0000000000540000-0x000000000068A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4348-318-0x00000000001F0000-0x0000000000200000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4396-277-0x0000000008240000-0x0000000008241000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4396-206-0x00000000006B0000-0x00000000006B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4396-220-0x0000000004EE0000-0x0000000004F0C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4396-211-0x0000000004F40000-0x0000000004F41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4496-218-0x0000000005360000-0x0000000005367000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4496-219-0x00000000080A0000-0x00000000080A1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4496-232-0x0000000005610000-0x0000000005611000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4496-213-0x0000000000C50000-0x0000000000C51000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4496-221-0x0000000007C40000-0x0000000007C41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4564-226-0x0000000002790000-0x0000000002792000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4652-243-0x00000000050C0000-0x00000000050C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4652-245-0x00000000050A0000-0x000000000559E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4652-233-0x0000000000770000-0x0000000000771000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4652-257-0x0000000005330000-0x0000000005332000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4652-253-0x00000000086E0000-0x00000000086E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4812-314-0x0000000005670000-0x0000000005C76000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4812-285-0x0000000000400000-0x000000000041C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4820-325-0x0000000000400000-0x0000000000D26000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4820-324-0x0000000002DB0000-0x00000000036BC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4864-321-0x00000000004C0000-0x000000000056E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4864-323-0x0000000000400000-0x000000000045D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4948-268-0x000000001B6B0000-0x000000001B6B2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4948-249-0x0000000000C20000-0x0000000000C21000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4948-262-0x0000000001360000-0x0000000001380000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4948-267-0x0000000001150000-0x0000000001151000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4948-258-0x0000000001140000-0x0000000001141000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4996-254-0x00000000004F0000-0x00000000004F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/4996-259-0x00000000027C0000-0x00000000027C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5012-300-0x0000000000400000-0x000000000041C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5012-317-0x0000000004FA0000-0x00000000055A6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5020-315-0x00000000053F0000-0x00000000053F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5060-260-0x00000000008D0000-0x00000000008D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5060-265-0x00000000051A0000-0x00000000051A1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5064-328-0x00000000050F0000-0x00000000050F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5152-344-0x0000000000400000-0x0000000000416000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5284-354-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5356-353-0x00000000024A0000-0x00000000024A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5456-362-0x0000000001520000-0x0000000001522000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5492-366-0x0000000005310000-0x0000000005311000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                memory/5540-367-0x0000000000FE0000-0x0000000000FE2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                Download