Overview

overview

10

Static

static

18be39daf6...5f.exe

windows7_x64

10

18be39daf6...5f.exe

windows10_x64

10

Analysis

  • max time kernel
    5s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    08/06/2021, 07:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    18be39daf69b6139f2e8c7e96cac0a5f.exe
  • Size 3.2MB
  • Sample210608-lt6d969tp6
  • SHA256 aa38af0f16d1e18d0e9e3ce186b7b4505fce90d26dcb925108c1923df691bd38
  • MD5 SHA1 SHA512
Score
10/10
redlinevidar706aspackv2infostealerpersistencestealerthemidaupx

Malware Config

Extracted

Family

  • vidar

Version

  • 39.2

Botnet

  • 706

C2

  • https://dimashub.tumblr.com

Attributes
  • profile_id

    706

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar Stealer 2 IoCs
    stealer
  • ASPack v2.12-2.42 8 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 7 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Delays execution with timeout.exe 3 IoCs
    evasion
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Script User-Agent 6 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\18be39daf69b6139f2e8c7e96cac0a5f.exe
    "C:\Users\Admin\AppData\Local\Temp\18be39daf69b6139f2e8c7e96cac0a5f.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3400
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1308
      • C:\Users\Admin\AppData\Local\Temp\7zSC1589434\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSC1589434\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2604
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c metina_1.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3424
          • C:\Users\Admin\AppData\Local\Temp\7zSC1589434\metina_1.exe
            metina_1.exe
            5⤵
            • Executes dropped EXE
            PID:3116
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c taskkill /im metina_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSC1589434\metina_1.exe" & del C:\ProgramData\*.dll & exit
              6⤵
                PID:5420
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /im metina_1.exe /f
                  7⤵
                  • Kills process with taskkill
                  PID:5104
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 6
                  7⤵
                  • Delays execution with timeout.exe
                  PID:7612
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c metina_2.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3672
            • C:\Users\Admin\AppData\Local\Temp\7zSC1589434\metina_2.exe
              metina_2.exe
              5⤵
              • Executes dropped EXE
              PID:2156
              • C:\Windows\SysWOW64\rUNdlL32.eXe
                "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get
                6⤵
                  PID:1308
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c metina_5.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3564
              • C:\Users\Admin\AppData\Local\Temp\7zSC1589434\metina_5.exe
                metina_5.exe
                5⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:3400
                • C:\Users\Admin\AppData\Roaming\8776361.exe
                  "C:\Users\Admin\AppData\Roaming\8776361.exe"
                  6⤵
                    PID:4124
                  • C:\Users\Admin\AppData\Roaming\3786581.exe
                    "C:\Users\Admin\AppData\Roaming\3786581.exe"
                    6⤵
                      PID:4208
                      • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                        7⤵
                          PID:4736
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c metina_6.exe
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3668
                    • C:\Users\Admin\AppData\Local\Temp\7zSC1589434\metina_6.exe
                      metina_6.exe
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:1088
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C powershell Add-MpPreference -ExclusionExtension .exe -Force
                        6⤵
                          PID:3740
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell Add-MpPreference -ExclusionExtension .exe -Force
                            7⤵
                              PID:3940
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\5C3WCXAC8495FVFRZ3V73H3H.exe"
                            6⤵
                              PID:5016
                              • C:\Users\Admin\AppData\Roaming\5C3WCXAC8495FVFRZ3V73H3H.exe
                                "C:\Users\Admin\AppData\Roaming\5C3WCXAC8495FVFRZ3V73H3H.exe"
                                7⤵
                                  PID:4276
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\ARSVA2VPLJLDZR4DIQGM10E1.exe"
                                6⤵
                                  PID:5028
                                  • C:\Users\Admin\AppData\Roaming\ARSVA2VPLJLDZR4DIQGM10E1.exe
                                    "C:\Users\Admin\AppData\Roaming\ARSVA2VPLJLDZR4DIQGM10E1.exe"
                                    7⤵
                                      PID:4152
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\TVGEF7VF342APJF5ASKJT42C.exe"
                                    6⤵
                                      PID:3092
                                      • C:\Users\Admin\AppData\Roaming\TVGEF7VF342APJF5ASKJT42C.exe
                                        "C:\Users\Admin\AppData\Roaming\TVGEF7VF342APJF5ASKJT42C.exe"
                                        7⤵
                                        • Loads dropped DLL
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1308
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\XHBCYQKJM0Z0OAM25WKVOGXI.exe"
                                      6⤵
                                        PID:4204
                                        • C:\Users\Admin\AppData\Roaming\XHBCYQKJM0Z0OAM25WKVOGXI.exe
                                          "C:\Users\Admin\AppData\Roaming\XHBCYQKJM0Z0OAM25WKVOGXI.exe"
                                          7⤵
                                            PID:5024
                                            • C:\Users\Admin\AppData\Roaming\XHBCYQKJM0Z0OAM25WKVOGXI.exe
                                              C:\Users\Admin\AppData\Roaming\XHBCYQKJM0Z0OAM25WKVOGXI.exe
                                              8⤵
                                                PID:5696
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\A6KL1TERT31SM5HN56WUCPLU.exe"
                                            6⤵
                                              PID:524
                                              • C:\Users\Admin\AppData\Roaming\A6KL1TERT31SM5HN56WUCPLU.exe
                                                "C:\Users\Admin\AppData\Roaming\A6KL1TERT31SM5HN56WUCPLU.exe"
                                                7⤵
                                                  PID:5052
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                    C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe
                                                    8⤵
                                                      PID:660
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\V82V4887T5OGXTBU0QNXTS98.exe"
                                                  6⤵
                                                    PID:4480
                                                    • C:\Users\Admin\AppData\Roaming\V82V4887T5OGXTBU0QNXTS98.exe
                                                      "C:\Users\Admin\AppData\Roaming\V82V4887T5OGXTBU0QNXTS98.exe"
                                                      7⤵
                                                        PID:5032
                                                        • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                                          "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o gulf.moneroocean.stream:10128 -u 499DUXTsgeNCiUBBZxPZaYj1uiSCAcCF8jDmNXkX8nTUTuZ9xQrR8kLhk8sNCeU5VMKZtoeNpQncYfLLWt3zRxGy3uMQSMV -p x -k -v=0 --donate-level=1 -t 1
                                                          8⤵
                                                            PID:5992
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\LFDPC843D476RLBM33MZJOWI.exe"
                                                        6⤵
                                                          PID:1756
                                                          • C:\Users\Admin\AppData\Roaming\LFDPC843D476RLBM33MZJOWI.exe
                                                            "C:\Users\Admin\AppData\Roaming\LFDPC843D476RLBM33MZJOWI.exe"
                                                            7⤵
                                                              PID:1456
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\3EG5Z6WAA3WAGU1UBBEOEN37.exe"
                                                            6⤵
                                                              PID:4364
                                                              • C:\Users\Admin\AppData\Roaming\3EG5Z6WAA3WAGU1UBBEOEN37.exe
                                                                "C:\Users\Admin\AppData\Roaming\3EG5Z6WAA3WAGU1UBBEOEN37.exe"
                                                                7⤵
                                                                  PID:4932
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{PJiX-NGBAh-mDDz-Ypn2u}\02035250095.exe"
                                                                    8⤵
                                                                      PID:5828
                                                                      • C:\Users\Admin\AppData\Local\Temp\{PJiX-NGBAh-mDDz-Ypn2u}\02035250095.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\{PJiX-NGBAh-mDDz-Ypn2u}\02035250095.exe"
                                                                        9⤵
                                                                          PID:6128
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\{PJiX-NGBAh-mDDz-Ypn2u}\02035250095.exe"
                                                                            10⤵
                                                                              PID:7504
                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                timeout /T 10 /NOBREAK
                                                                                11⤵
                                                                                • Delays execution with timeout.exe
                                                                                PID:7808
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{PJiX-NGBAh-mDDz-Ypn2u}\86991899567.exe" /mix
                                                                          8⤵
                                                                            PID:6468
                                                                            • C:\Users\Admin\AppData\Local\Temp\{PJiX-NGBAh-mDDz-Ypn2u}\86991899567.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\{PJiX-NGBAh-mDDz-Ypn2u}\86991899567.exe" /mix
                                                                              9⤵
                                                                                PID:6816
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\eNkmjCHm.exe"
                                                                                  10⤵
                                                                                    PID:7848
                                                                                    • C:\Users\Admin\AppData\Local\Temp\eNkmjCHm.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\eNkmjCHm.exe"
                                                                                      11⤵
                                                                                        PID:3980
                                                                                        • C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"
                                                                                          12⤵
                                                                                            PID:2420
                                                                                            • C:\Windows\SysWOW64\dllhost.exe
                                                                                              "C:\Windows\System32\dllhost.exe"
                                                                                              13⤵
                                                                                                PID:6788
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /c cmd < Questa.mui
                                                                                                13⤵
                                                                                                  PID:5428
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd
                                                                                                    14⤵
                                                                                                      PID:4260
                                                                                                • C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"
                                                                                                  12⤵
                                                                                                    PID:4996
                                                                                                    • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
                                                                                                      "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
                                                                                                      13⤵
                                                                                                        PID:5500
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\AYkdLcQoBcq & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{PJiX-NGBAh-mDDz-Ypn2u}\86991899567.exe"
                                                                                                  10⤵
                                                                                                    PID:7892
                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                      timeout 3
                                                                                                      11⤵
                                                                                                      • Delays execution with timeout.exe
                                                                                                      PID:5588
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{PJiX-NGBAh-mDDz-Ypn2u}\25740755469.exe" /mix
                                                                                                8⤵
                                                                                                  PID:7088
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{PJiX-NGBAh-mDDz-Ypn2u}\25740755469.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\{PJiX-NGBAh-mDDz-Ypn2u}\25740755469.exe" /mix
                                                                                                    9⤵
                                                                                                      PID:6476
                                                                                                      • C:\Users\Admin\AppData\Roaming\nailedp\edspolishpp.exe
                                                                                                        edspolishpp.exe
                                                                                                        10⤵
                                                                                                          PID:7348
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im "3EG5Z6WAA3WAGU1UBBEOEN37.exe" /f & erase "C:\Users\Admin\AppData\Roaming\3EG5Z6WAA3WAGU1UBBEOEN37.exe" & exit
                                                                                                      8⤵
                                                                                                        PID:5652
                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                          taskkill /im "3EG5Z6WAA3WAGU1UBBEOEN37.exe" /f
                                                                                                          9⤵
                                                                                                          • Kills process with taskkill
                                                                                                          PID:1180
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im "metina_6.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zSC1589434\metina_6.exe" & exit
                                                                                                    6⤵
                                                                                                      PID:6500
                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                        taskkill /im "metina_6.exe" /f
                                                                                                        7⤵
                                                                                                        • Kills process with taskkill
                                                                                                        PID:6896
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c metina_7.exe
                                                                                                  4⤵
                                                                                                    PID:3428
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c metina_8.exe
                                                                                                    4⤵
                                                                                                      PID:1928
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c metina_4.exe
                                                                                                      4⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:512
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC1589434\metina_4.exe
                                                                                                        metina_4.exe
                                                                                                        5⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Adds Run key to start application
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2300
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                          6⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:2496
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                          6⤵
                                                                                                            PID:4292
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c metina_3.exe
                                                                                                        4⤵
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3268
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC1589434\metina_3.exe
                                                                                                          metina_3.exe
                                                                                                          5⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3828
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-663LA.tmp\metina_3.tmp
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-663LA.tmp\metina_3.tmp" /SL5="$B004A,176358,92672,C:\Users\Admin\AppData\Local\Temp\7zSC1589434\metina_3.exe"
                                                                                                            6⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            PID:212
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-JUL8U.tmp\67________F.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-JUL8U.tmp\67________F.exe" /S /UID=burnerch1
                                                                                                              7⤵
                                                                                                                PID:3720
                                                                                                                • C:\Program Files\Mozilla Firefox\ETQHOLKJYB\ultramediaburner.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\ETQHOLKJYB\ultramediaburner.exe" /VERYSILENT
                                                                                                                  8⤵
                                                                                                                    PID:4208
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-HGIID.tmp\ultramediaburner.tmp
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-HGIID.tmp\ultramediaburner.tmp" /SL5="$8020A,281924,62464,C:\Program Files\Mozilla Firefox\ETQHOLKJYB\ultramediaburner.exe" /VERYSILENT
                                                                                                                      9⤵
                                                                                                                        PID:4784
                                                                                                                        • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                                                          "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                                                          10⤵
                                                                                                                            PID:3100
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8d-99fab-88a-b899b-ba4c941ef219c\Fenojokaxa.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8d-99fab-88a-b899b-ba4c941ef219c\Fenojokaxa.exe"
                                                                                                                        8⤵
                                                                                                                          PID:4840
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\25-e1152-9ba-e58a4-3e48b6ffa6aaf\Dilalisyzhe.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\25-e1152-9ba-e58a4-3e48b6ffa6aaf\Dilalisyzhe.exe"
                                                                                                                          8⤵
                                                                                                                            PID:4900
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5bwnxx23.xij\Cube_EU.exe & exit
                                                                                                                              9⤵
                                                                                                                                PID:4300
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5bwnxx23.xij\Cube_EU.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\5bwnxx23.xij\Cube_EU.exe
                                                                                                                                  10⤵
                                                                                                                                    PID:5292
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\VCBuilds\file31.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\VCBuilds\file31.exe
                                                                                                                                      11⤵
                                                                                                                                        PID:6120
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\VCBuilds\file31.exe
                                                                                                                                          "{path}"
                                                                                                                                          12⤵
                                                                                                                                            PID:7228
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /c taskkill /im file31.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\VCBuilds\file31.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                              13⤵
                                                                                                                                                PID:8180
                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                  taskkill /im file31.exe /f
                                                                                                                                                  14⤵
                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                  PID:6296
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\VCBuilds\setup.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\VCBuilds\setup.exe
                                                                                                                                            11⤵
                                                                                                                                              PID:5136
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-Q1J1T.tmp\setup.tmp
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-Q1J1T.tmp\setup.tmp" /SL5="$20364,1729489,56832,C:\Users\Admin\AppData\Local\Temp\VCBuilds\setup.exe"
                                                                                                                                                12⤵
                                                                                                                                                  PID:5652
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\VCBuilds\setup.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\VCBuilds\setup.exe" /SILENT
                                                                                                                                                    13⤵
                                                                                                                                                      PID:5832
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-T9A30.tmp\setup.tmp
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-T9A30.tmp\setup.tmp" /SL5="$10394,1729489,56832,C:\Users\Admin\AppData\Local\Temp\VCBuilds\setup.exe" /SILENT
                                                                                                                                                        14⤵
                                                                                                                                                          PID:5548
                                                                                                                                                          • C:\Program Files (x86)\viewerise\NDP472-KB4054531-Web.exe
                                                                                                                                                            "C:\Program Files (x86)\viewerise\NDP472-KB4054531-Web.exe" /q /norestart
                                                                                                                                                            15⤵
                                                                                                                                                              PID:6220
                                                                                                                                                              • C:\1bd816d02ac0e00c0e89e49a\Setup.exe
                                                                                                                                                                C:\1bd816d02ac0e00c0e89e49a\\Setup.exe /q /norestart /x86 /x64 /web
                                                                                                                                                                16⤵
                                                                                                                                                                  PID:6388
                                                                                                                                                              • C:\Program Files (x86)\viewerise\WeriseTweaker.exe
                                                                                                                                                                "C:\Program Files (x86)\viewerise\WeriseTweaker.exe" ss1
                                                                                                                                                                15⤵
                                                                                                                                                                  PID:6212
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-OGBPV.tmp\winhost.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-OGBPV.tmp\winhost.exe" ss1
                                                                                                                                                                  15⤵
                                                                                                                                                                    PID:6204
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1428
                                                                                                                                                                      16⤵
                                                                                                                                                                      • Program crash
                                                                                                                                                                      PID:6616
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\VCBuilds\2.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\VCBuilds\2.exe
                                                                                                                                                            11⤵
                                                                                                                                                              PID:5988
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hglixsou.zmu\001.exe & exit
                                                                                                                                                          9⤵
                                                                                                                                                            PID:2212
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hglixsou.zmu\001.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\hglixsou.zmu\001.exe
                                                                                                                                                              10⤵
                                                                                                                                                                PID:5388
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\42smsdds.fcv\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                              9⤵
                                                                                                                                                                PID:2056
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42smsdds.fcv\installer.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42smsdds.fcv\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                  10⤵
                                                                                                                                                                    PID:5484
                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dnsgk3ml.0sk\ebook.exe & exit
                                                                                                                                                                  9⤵
                                                                                                                                                                    PID:5152
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\dnsgk3ml.0sk\ebook.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\dnsgk3ml.0sk\ebook.exe
                                                                                                                                                                      10⤵
                                                                                                                                                                        PID:5580
                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                          C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\dnsgk3ml.0sk\EBOOKE~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\dnsgk3ml.0sk\ebook.exe
                                                                                                                                                                          11⤵
                                                                                                                                                                            PID:6992
                                                                                                                                                                            • C:\Windows\SysWOW64\RUNDLL32.EXE
                                                                                                                                                                              C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\dnsgk3ml.0sk\EBOOKE~1.DLL,XBlDLDaEBQ==
                                                                                                                                                                              12⤵
                                                                                                                                                                                PID:7140
                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp3067.tmp.ps1"
                                                                                                                                                                                  13⤵
                                                                                                                                                                                    PID:6788
                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\skx0iwxn.2sh\md1_1eaf.exe & exit
                                                                                                                                                                            9⤵
                                                                                                                                                                              PID:6008
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\skx0iwxn.2sh\md1_1eaf.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\skx0iwxn.2sh\md1_1eaf.exe
                                                                                                                                                                                10⤵
                                                                                                                                                                                  PID:4304
                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\trxrktnz.pom\gaoou.exe & exit
                                                                                                                                                                                9⤵
                                                                                                                                                                                  PID:3996
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\trxrktnz.pom\gaoou.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\trxrktnz.pom\gaoou.exe
                                                                                                                                                                                    10⤵
                                                                                                                                                                                      PID:5860
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                        11⤵
                                                                                                                                                                                          PID:6308
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                          11⤵
                                                                                                                                                                                            PID:6560
                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wrgvkm04.reo\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                        9⤵
                                                                                                                                                                                          PID:5016
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\wrgvkm04.reo\Setup3310.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\wrgvkm04.reo\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                            10⤵
                                                                                                                                                                                              PID:6748
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-VMI4V.tmp\Setup3310.tmp
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-VMI4V.tmp\Setup3310.tmp" /SL5="$1D039C,138429,56832,C:\Users\Admin\AppData\Local\Temp\wrgvkm04.reo\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                11⤵
                                                                                                                                                                                                  PID:6792
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-RTO47.tmp\Setup.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-RTO47.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                      PID:6468
                                                                                                                                                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                          PID:7116
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-1T3FS.tmp\lylal220.tmp
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-1T3FS.tmp\lylal220.tmp" /SL5="$204A0,491750,408064,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                              PID:5012
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-B57AI.tmp\56FT____________________.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-B57AI.tmp\56FT____________________.exe" /S /UID=lylal220
                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                  PID:5416
                                                                                                                                                                                                                  • C:\Program Files\7-Zip\PZUUYZCXSE\irecord.exe
                                                                                                                                                                                                                    "C:\Program Files\7-Zip\PZUUYZCXSE\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                      PID:8188
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-IRM0L.tmp\irecord.tmp
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-IRM0L.tmp\irecord.tmp" /SL5="$504D6,6139911,56832,C:\Program Files\7-Zip\PZUUYZCXSE\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                          PID:7268
                                                                                                                                                                                                                          • C:\Program Files (x86)\recording\i-record.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                              PID:5948
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\29-028cd-4aa-354aa-42d3e3b450e63\Qaegyjisasae.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\29-028cd-4aa-354aa-42d3e3b450e63\Qaegyjisasae.exe"
                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                            PID:6308
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\91-50bb5-e57-53fab-b5e7790ee9582\Tyqafuwiwa.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\91-50bb5-e57-53fab-b5e7790ee9582\Tyqafuwiwa.exe"
                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                              PID:6792
                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\v2zy5134.k5b\001.exe & exit
                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                  PID:2256
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\v2zy5134.k5b\001.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\v2zy5134.k5b\001.exe
                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                      PID:1648
                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3ejgf0lc.n40\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                                      PID:4236
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3ejgf0lc.n40\installer.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3ejgf0lc.n40\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                          PID:6976
                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ebzbt0hs.x34\gaoou.exe & exit
                                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                                          PID:5444
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ebzbt0hs.x34\gaoou.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\ebzbt0hs.x34\gaoou.exe
                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                              PID:3896
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                19⤵
                                                                                                                                                                                                                                                  PID:3940
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                  19⤵
                                                                                                                                                                                                                                                    PID:4960
                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yrth5q4c.swk\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                  PID:6832
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yrth5q4c.swk\Setup3310.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\yrth5q4c.swk\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                      PID:4364
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-K87UM.tmp\Setup3310.tmp
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-K87UM.tmp\Setup3310.tmp" /SL5="$1058E,138429,56832,C:\Users\Admin\AppData\Local\Temp\yrth5q4c.swk\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                                                                        19⤵
                                                                                                                                                                                                                                                          PID:4976
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-AKQCG.tmp\Setup.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-AKQCG.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                              PID:5560
                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gsqbcjdq.cnt\google-game.exe & exit
                                                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                                                          PID:5920
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\gsqbcjdq.cnt\google-game.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\gsqbcjdq.cnt\google-game.exe
                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                              PID:6288
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                                "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get
                                                                                                                                                                                                                                                                19⤵
                                                                                                                                                                                                                                                                  PID:4952
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                        PID:7112
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-VHVVA.tmp\LabPicV3.tmp
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-VHVVA.tmp\LabPicV3.tmp" /SL5="$A007E,506086,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                            PID:4664
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-5AJP5.tmp\_____________.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-5AJP5.tmp\_____________.exe" /S /UID=lab214
                                                                                                                                                                                                                                                              15⤵
                                                                                                                                                                                                                                                                PID:6992
                                                                                                                                                                                                                                                                • C:\Program Files\Microsoft Office 15\EGYUSUMLKM\prolab.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Microsoft Office 15\EGYUSUMLKM\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                    PID:7932
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-V8VJ2.tmp\prolab.tmp
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-V8VJ2.tmp\prolab.tmp" /SL5="$80494,575243,216576,C:\Program Files\Microsoft Office 15\EGYUSUMLKM\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                                                                      17⤵
                                                                                                                                                                                                                                                                        PID:8008
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6c-1f859-7dd-a848e-eb04b9ab1db30\Webugatahu.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6c-1f859-7dd-a848e-eb04b9ab1db30\Webugatahu.exe"
                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                        PID:7976
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\97-f8cf1-f67-5b996-80555bcc9e162\Lowijaerera.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\97-f8cf1-f67-5b996-80555bcc9e162\Lowijaerera.exe"
                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                          PID:8016
                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vowliwhq.i5f\001.exe & exit
                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                              PID:6348
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\vowliwhq.i5f\001.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\vowliwhq.i5f\001.exe
                                                                                                                                                                                                                                                                                18⤵
                                                                                                                                                                                                                                                                                  PID:8120
                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2p5mdh2f.meh\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                                                  PID:6304
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2p5mdh2f.meh\installer.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2p5mdh2f.meh\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                                                      PID:3976
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mj23cuya.osl\gaoou.exe & exit
                                                                                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                                                                                      PID:1708
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mj23cuya.osl\gaoou.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\mj23cuya.osl\gaoou.exe
                                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                                          PID:5400
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                            19⤵
                                                                                                                                                                                                                                                                                              PID:1840
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                              19⤵
                                                                                                                                                                                                                                                                                                PID:1088
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1lmd1y4w.y3u\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                              PID:224
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1lmd1y4w.y3u\Setup3310.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\1lmd1y4w.y3u\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                                                                                                                                18⤵
                                                                                                                                                                                                                                                                                                  PID:6848
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-M08NV.tmp\Setup3310.tmp
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-M08NV.tmp\Setup3310.tmp" /SL5="$40328,138429,56832,C:\Users\Admin\AppData\Local\Temp\1lmd1y4w.y3u\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                                                                                                                    19⤵
                                                                                                                                                                                                                                                                                                      PID:8140
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-J3ANE.tmp\Setup.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-J3ANE.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                                                                                                                          PID:7876
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1ngqgka4.gxq\google-game.exe & exit
                                                                                                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                                                                                                      PID:7956
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1ngqgka4.gxq\google-game.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\1ngqgka4.gxq\google-game.exe
                                                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                                                          PID:2960
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"
                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                  PID:7136
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\1108269.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\1108269.exe"
                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                      PID:7532
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\4510782.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\4510782.exe"
                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                        PID:7600
                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Data Finder\Versium Research\003.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Data Finder\Versium Research\003.exe"
                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                        PID:2304
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                          PID:7084
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                              PID:4112
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                              PID:5616
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                                                  PID:7332
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                    taskkill /im RunWW.exe /f
                                                                                                                                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                    PID:5216
                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                  PID:4500
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                      PID:7388
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                        PID:692
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\y3e5by4y.2ws\google-game.exe & exit
                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                PID:6612
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\y3e5by4y.2ws\google-game.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\y3e5by4y.2ws\google-game.exe
                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                    PID:6164
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get
                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                        PID:7000
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dr2zptam.m4p\005.exe & exit
                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                      PID:6128
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dr2zptam.m4p\005.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\dr2zptam.m4p\005.exe
                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                          PID:7920
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2vmhuzli.hgq\toolspab1.exe & exit
                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                          PID:4244
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2vmhuzli.hgq\toolspab1.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\2vmhuzli.hgq\toolspab1.exe
                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                              PID:3864
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2vmhuzli.hgq\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2vmhuzli.hgq\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                  PID:7408
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ohzzxveu.oad\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                PID:7824
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ohzzxveu.oad\installer.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\ohzzxveu.oad\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                    PID:8152
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ety5egxf.hnh\702564a0.exe & exit
                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                    PID:3424
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ety5egxf.hnh\702564a0.exe
                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\ety5egxf.hnh\702564a0.exe
                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                        PID:5172
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c metina_10.exe
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:3940
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c metina_9.exe
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                PID:1144
                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:3196
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:3928
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:4632
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:5228
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:5308
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:4188
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding E2F8B0CFD048CF6EA887CFA58EBA32A7 C
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:6024
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:5196
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:5376
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:6808
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:5168
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:7208
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:6420
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:7396
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4584
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:360

                                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                              memory/212-181-0x0000000002100000-0x0000000002101000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/660-357-0x0000000004C70000-0x0000000004C71000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/964-236-0x0000028D5D180000-0x0000028D5D1F0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/1008-264-0x00000133CC560000-0x00000133CC5D0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/1064-227-0x0000021D7A270000-0x0000021D7A2E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/1088-230-0x0000000005AE0000-0x0000000005AE1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/1088-167-0x00000000006B0000-0x00000000006B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/1236-265-0x00000145B3CA0000-0x00000145B3D10000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/1260-269-0x00000261A8860000-0x00000261A88D0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/1308-352-0x0000000002F60000-0x0000000002F61000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/1308-350-0x0000000077C00000-0x0000000077D8E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/1308-216-0x0000000001140000-0x000000000119C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/1308-206-0x0000000000FEC000-0x00000000010ED000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/1368-243-0x00000235F9560000-0x00000235F95D0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/1456-343-0x00000000050A0000-0x000000000559E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/1824-253-0x0000018F53040000-0x0000018F530B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/2336-212-0x0000023ABF3A0000-0x0000023ABF3EB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/2336-217-0x0000023ABF850000-0x0000023ABF8C0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/2376-284-0x000001565C440000-0x000001565C4B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/2536-251-0x0000018121CD0000-0x0000018121D40000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/2604-134-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/2604-131-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/2604-137-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/2604-136-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/2604-135-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/2604-133-0x0000000000400000-0x000000000051D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/2604-130-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/2604-132-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/2624-277-0x0000024DE6610000-0x0000024DE6680000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/2632-285-0x0000022E04A00000-0x0000022E04A70000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3100-344-0x00000000026C0000-0x00000000026C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3100-353-0x00000000026C2000-0x00000000026C4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3100-354-0x00000000026C4000-0x00000000026C5000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3100-355-0x00000000026C5000-0x00000000026C7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3116-346-0x0000000000400000-0x00000000004A5000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3116-339-0x00000000021A0000-0x0000000002237000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3196-225-0x0000024BF9C90000-0x0000024BF9D00000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3400-169-0x0000000000F70000-0x0000000000F71000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3400-180-0x0000000001800000-0x0000000001802000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3400-174-0x00000000017B0000-0x00000000017CB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3720-207-0x00000000029B0000-0x00000000029B2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3828-163-0x0000000000400000-0x000000000041D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3928-257-0x00000290E30D0000-0x00000290E3140000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3940-348-0x000000007EB60000-0x000000007EB61000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3940-349-0x00000000070F3000-0x00000000070F4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3940-238-0x00000000076E0000-0x00000000076E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3940-256-0x0000000007DD0000-0x0000000007DD1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3940-198-0x0000000006FD0000-0x0000000006FD1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3940-254-0x0000000007FB0000-0x0000000007FB1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3940-260-0x0000000008050000-0x0000000008051000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3940-263-0x00000000070F0000-0x00000000070F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3940-271-0x00000000070F2000-0x00000000070F3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/3940-199-0x0000000007730000-0x0000000007731000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4124-234-0x00000000013E0000-0x00000000013E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4124-222-0x00000000013D0000-0x00000000013D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4124-245-0x00000000014F0000-0x0000000001510000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4124-252-0x0000000001510000-0x0000000001511000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4124-210-0x0000000000CB0000-0x0000000000CB1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4208-255-0x0000000004210000-0x0000000004211000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4208-249-0x00000000049D0000-0x00000000049D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4208-235-0x0000000002060000-0x0000000002061000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4208-226-0x0000000000010000-0x0000000000011000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4208-242-0x0000000004180000-0x000000000418E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4208-244-0x00000000091B0000-0x00000000091B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4208-314-0x0000000000400000-0x0000000000416000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4632-306-0x0000024013DD0000-0x0000024013E1B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4632-307-0x00000240140D0000-0x0000024014141000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4736-290-0x0000000005780000-0x0000000005781000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4784-338-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4840-333-0x0000000001F00000-0x0000000001F02000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4900-347-0x0000000002410000-0x0000000002412000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/4900-351-0x0000000002412000-0x0000000002414000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/5024-341-0x0000000005710000-0x0000000005C0E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                                              memory/5052-345-0x0000000004980000-0x0000000004981000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                              Download