Overview

overview

10

Static

static

D0CD0B55D6...0F.exe

windows7_x64

10

D0CD0B55D6...0F.exe

windows10_x64

Analysis

  • max time kernel
    12s
  • max time network
    114s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    09-06-2021 18:02

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    D0CD0B55D658B5C1109F87AF54CF7A0F.exe

  • Size

    3.9MB

  • MD5

    d0cd0b55d658b5c1109f87af54cf7a0f

  • SHA1

    6c7e977a1096c9fa4fb3e5e45a5009b42a23fd4d

  • SHA256

    2507f070a5e9c57e22b5c3ce3b54fade48f9aba2d444fa7d0c48146a94309e06

  • SHA512

    de8c8a3abb4d1484da6dbea9d628a6b99f889bab8852ba14f71cb1c952433ec197cdd6c88faa580dc688227749f3faaebed171523bf369e9b68001f82b34abe1

Score
10/10
plugxsmokeloadervidaraspackv2backdoorpersistencespywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/
rc4.i32
rc4.i32

Signatures

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 16 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
    evasion
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies data under HKEY_USERS 8 IoCs
  • Modifies registry class 9 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 6 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
    1⤵
      PID:1964
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2856
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
          PID:2804
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
          1⤵
            PID:2796
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
              PID:2540
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
              1⤵
                PID:2504
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1376
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s SENS
                  1⤵
                    PID:1352
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                    1⤵
                      PID:1180
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1172
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                        1⤵
                          PID:344
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                          1⤵
                            PID:996
                          • C:\Users\Admin\AppData\Local\Temp\D0CD0B55D658B5C1109F87AF54CF7A0F.exe
                            "C:\Users\Admin\AppData\Local\Temp\D0CD0B55D658B5C1109F87AF54CF7A0F.exe"
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3152
                            • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                              "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:1828
                              • C:\Users\Admin\AppData\Local\Temp\7zS427E7C24\setup_install.exe
                                "C:\Users\Admin\AppData\Local\Temp\7zS427E7C24\setup_install.exe"
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of WriteProcessMemory
                                PID:1640
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c metina_1.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1120
                                  • C:\Users\Admin\AppData\Local\Temp\7zS427E7C24\metina_1.exe
                                    metina_1.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Checks computer location settings
                                    • Modifies registry class
                                    PID:2832
                                    • C:\Windows\SysWOW64\rUNdlL32.eXe
                                      "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get
                                      6⤵
                                      • Loads dropped DLL
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4388
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c metina_2.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1116
                                  • C:\Users\Admin\AppData\Local\Temp\7zS427E7C24\metina_2.exe
                                    metina_2.exe
                                    5⤵
                                    • Executes dropped EXE
                                    PID:2876
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c metina_4.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3376
                                  • C:\Users\Admin\AppData\Local\Temp\7zS427E7C24\metina_4.exe
                                    metina_4.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    PID:1008
                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      6⤵
                                      • Executes dropped EXE
                                      PID:4360
                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      6⤵
                                        PID:4456
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c metina_3.exe
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:2108
                                    • C:\Users\Admin\AppData\Local\Temp\7zS427E7C24\metina_3.exe
                                      metina_3.exe
                                      5⤵
                                      • Executes dropped EXE
                                      PID:3440
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c taskkill /im metina_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS427E7C24\metina_3.exe" & del C:\ProgramData\*.dll & exit
                                        6⤵
                                          PID:5840
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /im metina_3.exe /f
                                            7⤵
                                            • Kills process with taskkill
                                            PID:6008
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout /t 6
                                            7⤵
                                            • Delays execution with timeout.exe
                                            PID:3148
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c metina_5.exe
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3896
                                      • C:\Users\Admin\AppData\Local\Temp\7zS427E7C24\metina_5.exe
                                        metina_5.exe
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:2272
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c metina_6.exe
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3960
                                      • C:\Users\Admin\AppData\Local\Temp\7zS427E7C24\metina_6.exe
                                        metina_6.exe
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3604
                                        • C:\Users\Admin\AppData\Roaming\3166934.exe
                                          "C:\Users\Admin\AppData\Roaming\3166934.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4924
                                        • C:\Users\Admin\AppData\Roaming\4144133.exe
                                          "C:\Users\Admin\AppData\Roaming\4144133.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          PID:5048
                                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                            "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                            7⤵
                                              PID:4944
                                          • C:\Users\Admin\AppData\Roaming\3114728.exe
                                            "C:\Users\Admin\AppData\Roaming\3114728.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            PID:204
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c metina_8.exe
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:856
                                        • C:\Users\Admin\AppData\Local\Temp\7zS427E7C24\metina_8.exe
                                          metina_8.exe
                                          5⤵
                                          • Executes dropped EXE
                                          PID:4128
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c metina_9.exe
                                        4⤵
                                          PID:740
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c metina_10.exe
                                          4⤵
                                            PID:188
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c metina_7.exe
                                            4⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:2208
                                    • \??\c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                      1⤵
                                      • Suspicious use of SetThreadContext
                                      • Modifies data under HKEY_USERS
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:412
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                        2⤵
                                        • Checks processor information in registry
                                        • Modifies data under HKEY_USERS
                                        • Modifies registry class
                                        PID:4488
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                        2⤵
                                          PID:4308
                                      • C:\Users\Admin\AppData\Local\Temp\7zS427E7C24\metina_7.exe
                                        metina_7.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:3968
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C powershell Add-MpPreference -ExclusionExtension .exe -Force
                                          2⤵
                                            PID:4276
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              powershell Add-MpPreference -ExclusionExtension .exe -Force
                                              3⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4752
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\J64HNY07YKJZGPYN9SKN50JQ.exe"
                                            2⤵
                                              PID:4888
                                              • C:\Users\Admin\AppData\Roaming\J64HNY07YKJZGPYN9SKN50JQ.exe
                                                "C:\Users\Admin\AppData\Roaming\J64HNY07YKJZGPYN9SKN50JQ.exe"
                                                3⤵
                                                  PID:4228
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{cOy8-QWgGS-0k6t-FCQ25}\76634105893.exe"
                                                    4⤵
                                                      PID:5716
                                                      • C:\Users\Admin\AppData\Local\Temp\{cOy8-QWgGS-0k6t-FCQ25}\76634105893.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\{cOy8-QWgGS-0k6t-FCQ25}\76634105893.exe"
                                                        5⤵
                                                          PID:5904
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{cOy8-QWgGS-0k6t-FCQ25}\48953217672.exe" /mix
                                                        4⤵
                                                          PID:6228
                                                          • C:\Users\Admin\AppData\Local\Temp\{cOy8-QWgGS-0k6t-FCQ25}\48953217672.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\{cOy8-QWgGS-0k6t-FCQ25}\48953217672.exe" /mix
                                                            5⤵
                                                              PID:6472
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\WPBvI.exe"
                                                                6⤵
                                                                  PID:4200
                                                                  • C:\Users\Admin\AppData\Local\Temp\WPBvI.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\WPBvI.exe"
                                                                    7⤵
                                                                      PID:6360
                                                                      • C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"
                                                                        8⤵
                                                                          PID:6288
                                                                          • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
                                                                            "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
                                                                            9⤵
                                                                              PID:2528
                                                                          • C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"
                                                                            8⤵
                                                                              PID:6672
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c cmd < Gote.aiff
                                                                                9⤵
                                                                                  PID:4748
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    cmd
                                                                                    10⤵
                                                                                      PID:7120
                                                                                      • C:\Windows\SysWOW64\findstr.exe
                                                                                        findstr /V /R "^LjaIWKsNCnNrcrIGrRSgkvhmTVtiUhayrefgTaEfPZCszvASPFwjlwZgZTOwGpSgyIZzOzMKjDnkUVybxkagkuUerqfqE$" Diritto.aiff
                                                                                        11⤵
                                                                                          PID:9324
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Gabbie.exe.com
                                                                                          Gabbie.exe.com c
                                                                                          11⤵
                                                                                            PID:9872
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Gabbie.exe.com
                                                                                              C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Gabbie.exe.com c
                                                                                              12⤵
                                                                                                PID:9944
                                                                                            • C:\Windows\SysWOW64\PING.EXE
                                                                                              ping 127.0.0.1 -n 30
                                                                                              11⤵
                                                                                              • Runs ping.exe
                                                                                              PID:4172
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\iNDwSlllj & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{cOy8-QWgGS-0k6t-FCQ25}\48953217672.exe"
                                                                                    6⤵
                                                                                      PID:4500
                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                        timeout 3
                                                                                        7⤵
                                                                                        • Delays execution with timeout.exe
                                                                                        PID:9956
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{cOy8-QWgGS-0k6t-FCQ25}\90999311077.exe" /mix
                                                                                  4⤵
                                                                                    PID:6752
                                                                                    • C:\Users\Admin\AppData\Local\Temp\{cOy8-QWgGS-0k6t-FCQ25}\90999311077.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\{cOy8-QWgGS-0k6t-FCQ25}\90999311077.exe" /mix
                                                                                      5⤵
                                                                                        PID:6300
                                                                                        • C:\Users\Admin\AppData\Roaming\nailedp\edspolishpp.exe
                                                                                          edspolishpp.exe
                                                                                          6⤵
                                                                                            PID:7232
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im "J64HNY07YKJZGPYN9SKN50JQ.exe" /f & erase "C:\Users\Admin\AppData\Roaming\J64HNY07YKJZGPYN9SKN50JQ.exe" & exit
                                                                                        4⤵
                                                                                          PID:6980
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            taskkill /im "J64HNY07YKJZGPYN9SKN50JQ.exe" /f
                                                                                            5⤵
                                                                                            • Kills process with taskkill
                                                                                            PID:6264
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Roaming\O1SAB9IWO0EIEC9E8EJJ8NUK.exe"
                                                                                      2⤵
                                                                                        PID:5080
                                                                                        • C:\Users\Admin\AppData\Roaming\O1SAB9IWO0EIEC9E8EJJ8NUK.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\O1SAB9IWO0EIEC9E8EJJ8NUK.exe"
                                                                                          3⤵
                                                                                            PID:3972
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im "metina_7.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS427E7C24\metina_7.exe" & exit
                                                                                          2⤵
                                                                                            PID:6392
                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                              taskkill /im "metina_7.exe" /f
                                                                                              3⤵
                                                                                              • Kills process with taskkill
                                                                                              PID:4012
                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-CDGEC.tmp\metina_5.tmp
                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-CDGEC.tmp\metina_5.tmp" /SL5="$701D6,176358,92672,C:\Users\Admin\AppData\Local\Temp\7zS427E7C24\metina_5.exe"
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          PID:2828
                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-981TO.tmp\67________F.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-981TO.tmp\67________F.exe" /S /UID=burnerch1
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:4528
                                                                                            • C:\Program Files\Windows Mail\EXYYUUUIKS\ultramediaburner.exe
                                                                                              "C:\Program Files\Windows Mail\EXYYUUUIKS\ultramediaburner.exe" /VERYSILENT
                                                                                              3⤵
                                                                                                PID:4776
                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-7HIVC.tmp\ultramediaburner.tmp
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-7HIVC.tmp\ultramediaburner.tmp" /SL5="$401F8,281924,62464,C:\Program Files\Windows Mail\EXYYUUUIKS\ultramediaburner.exe" /VERYSILENT
                                                                                                  4⤵
                                                                                                    PID:3884
                                                                                                    • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                                      "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                                      5⤵
                                                                                                        PID:4772
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0c-416d5-7ba-e04b4-771c97dcef85e\SHogumaecywe.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0c-416d5-7ba-e04b4-771c97dcef85e\SHogumaecywe.exe"
                                                                                                    3⤵
                                                                                                      PID:840
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\e3-b3d0e-fe4-dd3b6-132b97ba2836f\Litixubexe.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\e3-b3d0e-fe4-dd3b6-132b97ba2836f\Litixubexe.exe"
                                                                                                      3⤵
                                                                                                        PID:5112
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2nnop52b.453\001.exe & exit
                                                                                                          4⤵
                                                                                                            PID:4848
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2nnop52b.453\001.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\2nnop52b.453\001.exe
                                                                                                              5⤵
                                                                                                                PID:5140
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x4ytoazl.v00\GcleanerEU.exe /eufive & exit
                                                                                                              4⤵
                                                                                                                PID:4188
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0d4lprmt.4h0\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                4⤵
                                                                                                                  PID:3036
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0d4lprmt.4h0\installer.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\0d4lprmt.4h0\installer.exe /qn CAMPAIGN="654"
                                                                                                                    5⤵
                                                                                                                      PID:5388
                                                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\0d4lprmt.4h0\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\0d4lprmt.4h0\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1623002279 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                        6⤵
                                                                                                                          PID:6776
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sdwqh354.vt5\gaoou.exe & exit
                                                                                                                      4⤵
                                                                                                                        PID:5356
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\sdwqh354.vt5\gaoou.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\sdwqh354.vt5\gaoou.exe
                                                                                                                          5⤵
                                                                                                                            PID:5764
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                              6⤵
                                                                                                                                PID:5948
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                6⤵
                                                                                                                                  PID:3708
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vo0do23c.1nl\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                              4⤵
                                                                                                                                PID:5984
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\vo0do23c.1nl\Setup3310.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\vo0do23c.1nl\Setup3310.exe /Verysilent /subid=623
                                                                                                                                  5⤵
                                                                                                                                    PID:2292
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-JEUL4.tmp\Setup3310.tmp
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-JEUL4.tmp\Setup3310.tmp" /SL5="$4028C,138429,56832,C:\Users\Admin\AppData\Local\Temp\vo0do23c.1nl\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                      6⤵
                                                                                                                                        PID:5236
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-SQJ7H.tmp\Setup.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-SQJ7H.tmp\Setup.exe" /Verysilent
                                                                                                                                          7⤵
                                                                                                                                            PID:6092
                                                                                                                                            • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                                                                              "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                                                                                              8⤵
                                                                                                                                                PID:5960
                                                                                                                                              • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                                                                                "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                8⤵
                                                                                                                                                  PID:6000
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-5S2AM.tmp\LabPicV3.tmp
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-5S2AM.tmp\LabPicV3.tmp" /SL5="$20440,506086,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                    9⤵
                                                                                                                                                      PID:752
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-TLUGP.tmp\_____________.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-TLUGP.tmp\_____________.exe" /S /UID=lab214
                                                                                                                                                        10⤵
                                                                                                                                                          PID:4712
                                                                                                                                                          • C:\Program Files\Mozilla Firefox\IMTGJHBBTA\prolab.exe
                                                                                                                                                            "C:\Program Files\Mozilla Firefox\IMTGJHBBTA\prolab.exe" /VERYSILENT
                                                                                                                                                            11⤵
                                                                                                                                                              PID:6736
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-2V93V.tmp\prolab.tmp
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-2V93V.tmp\prolab.tmp" /SL5="$801A4,575243,216576,C:\Program Files\Mozilla Firefox\IMTGJHBBTA\prolab.exe" /VERYSILENT
                                                                                                                                                                12⤵
                                                                                                                                                                  PID:6808
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe-0b5bb-b5c-ba3ad-0a393e1a8588d\Gaegivyzhaedae.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe-0b5bb-b5c-ba3ad-0a393e1a8588d\Gaegivyzhaedae.exe"
                                                                                                                                                                11⤵
                                                                                                                                                                  PID:6788
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\39-3f9dc-5c7-3129b-3fefb506a4769\Qajeshiwaego.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\39-3f9dc-5c7-3129b-3fefb506a4769\Qajeshiwaego.exe"
                                                                                                                                                                  11⤵
                                                                                                                                                                    PID:6832
                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2f10rd3k.fj2\001.exe & exit
                                                                                                                                                                      12⤵
                                                                                                                                                                        PID:8072
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2f10rd3k.fj2\001.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\2f10rd3k.fj2\001.exe
                                                                                                                                                                          13⤵
                                                                                                                                                                            PID:5748
                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zqa5rq0c.xvc\GcleanerEU.exe /eufive & exit
                                                                                                                                                                          12⤵
                                                                                                                                                                            PID:6520
                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mnckgk3l.vjd\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                            12⤵
                                                                                                                                                                              PID:6408
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mnckgk3l.vjd\installer.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\mnckgk3l.vjd\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                13⤵
                                                                                                                                                                                  PID:9292
                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\i1mkkgrt.1gw\gaoou.exe & exit
                                                                                                                                                                                12⤵
                                                                                                                                                                                  PID:9364
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\i1mkkgrt.1gw\gaoou.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\i1mkkgrt.1gw\gaoou.exe
                                                                                                                                                                                    13⤵
                                                                                                                                                                                      PID:9668
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                        14⤵
                                                                                                                                                                                          PID:9836
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                          14⤵
                                                                                                                                                                                            PID:7512
                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kjwy25eo.iic\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                        12⤵
                                                                                                                                                                                          PID:3064
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\kjwy25eo.iic\Setup3310.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\kjwy25eo.iic\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                            13⤵
                                                                                                                                                                                              PID:7196
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-LJD47.tmp\Setup3310.tmp
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-LJD47.tmp\Setup3310.tmp" /SL5="$105A0,138429,56832,C:\Users\Admin\AppData\Local\Temp\kjwy25eo.iic\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                14⤵
                                                                                                                                                                                                  PID:7256
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-1VEFC.tmp\Setup.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-1VEFC.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                    15⤵
                                                                                                                                                                                                      PID:8360
                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wg41lucr.cny\google-game.exe & exit
                                                                                                                                                                                                12⤵
                                                                                                                                                                                                  PID:7716
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\wg41lucr.cny\google-game.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\wg41lucr.cny\google-game.exe
                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                      PID:7828
                                                                                                                                                                                                      • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get
                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                          PID:8064
                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tw3uumvv.h0z\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                        PID:5636
                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\me41mu0v.vce\005.exe & exit
                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                          PID:8308
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\me41mu0v.vce\005.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\me41mu0v.vce\005.exe
                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                              PID:8664
                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\udvoalsi.5e3\toolspab1.exe & exit
                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                              PID:8556
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\udvoalsi.5e3\toolspab1.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\udvoalsi.5e3\toolspab1.exe
                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                  PID:8960
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\udvoalsi.5e3\toolspab1.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\udvoalsi.5e3\toolspab1.exe
                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                      PID:4228
                                                                                                                                                                                                        • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                            PID:5520
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-KU26E.tmp\lylal220.tmp
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-KU26E.tmp\lylal220.tmp" /SL5="$40458,491750,408064,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                PID:6092
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-GQD5K.tmp\56FT____________________.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-GQD5K.tmp\56FT____________________.exe" /S /UID=lylal220
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                    PID:6080
                                                                                                                                                                                                                    • C:\Program Files\Reference Assemblies\BQSLSJIRFZ\irecord.exe
                                                                                                                                                                                                                      "C:\Program Files\Reference Assemblies\BQSLSJIRFZ\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                        PID:7020
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-OSBHP.tmp\irecord.tmp
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-OSBHP.tmp\irecord.tmp" /SL5="$30454,6139911,56832,C:\Program Files\Reference Assemblies\BQSLSJIRFZ\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                            PID:7136
                                                                                                                                                                                                                            • C:\Program Files (x86)\recording\i-record.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                PID:6528
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\c2-6215c-3d3-5b7b0-bfd2337289cb1\Vokorigygu.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\c2-6215c-3d3-5b7b0-bfd2337289cb1\Vokorigygu.exe"
                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                              PID:7052
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\72-9fae6-980-2968b-50517863007c9\Xahaejaefaeko.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\72-9fae6-980-2968b-50517863007c9\Xahaejaefaeko.exe"
                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                PID:7084
                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fwfxwnts.kqy\001.exe & exit
                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                    PID:9192
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fwfxwnts.kqy\001.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\fwfxwnts.kqy\001.exe
                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                        PID:4332
                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gpvj3ejs.ggt\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                        PID:4512
                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yy0ezeoq.udf\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                          PID:9040
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\yy0ezeoq.udf\installer.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\yy0ezeoq.udf\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                              PID:9372
                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kxtnwn5y.cg1\gaoou.exe & exit
                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                              PID:9448
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\kxtnwn5y.cg1\gaoou.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\kxtnwn5y.cg1\gaoou.exe
                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                  PID:9620
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                      PID:9744
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                        PID:7496
                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dei5z0yv.auh\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                      PID:5572
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\dei5z0yv.auh\Setup3310.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\dei5z0yv.auh\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                          PID:7336
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-73V8O.tmp\Setup3310.tmp
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-73V8O.tmp\Setup3310.tmp" /SL5="$305BA,138429,56832,C:\Users\Admin\AppData\Local\Temp\dei5z0yv.auh\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                              PID:7360
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-ES42O.tmp\Setup.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-ES42O.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                                  PID:8692
                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qvobt0r2.my1\google-game.exe & exit
                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                              PID:7836
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\qvobt0r2.my1\google-game.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\qvobt0r2.my1\google-game.exe
                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                  PID:8164
                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yrvy2g2a.5qg\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                  PID:5560
                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0ljrmadn.3zd\005.exe & exit
                                                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                                                    PID:8224
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0ljrmadn.3zd\005.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\0ljrmadn.3zd\005.exe
                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                        PID:8608
                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bxadscl4.hh1\toolspab1.exe & exit
                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                        PID:8464
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bxadscl4.hh1\toolspab1.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\bxadscl4.hh1\toolspab1.exe
                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                            PID:8908
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bxadscl4.hh1\toolspab1.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\bxadscl4.hh1\toolspab1.exe
                                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                                PID:9596
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                      PID:4432
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                          PID:5264
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                            taskkill /im RunWW.exe /f
                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                            PID:2568
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                            timeout /t 6
                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                            PID:4804
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                          PID:4380
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                              PID:4796
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                PID:6852
                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Data Finder\Versium Research\Aq7KJ3GWvdkS.exe
                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Data Finder\Versium Research\Aq7KJ3GWvdkS.exe"
                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                PID:4220
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Data Finder\Versium Research\Aq7KJ3GWvdkS.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Data Finder\Versium Research\Aq7KJ3GWvdkS.exe"
                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                    PID:6188
                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3c2encxb.2ui\google-game.exe & exit
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:5332
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3c2encxb.2ui\google-game.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3c2encxb.2ui\google-game.exe
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:4380
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:5916
                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\r1tj4rrs.gri\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:4424
                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xlrywiyd.25j\005.exe & exit
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:904
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\xlrywiyd.25j\005.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\xlrywiyd.25j\005.exe
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                        PID:4276
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3d5vzha0.ggd\toolspab1.exe & exit
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:4800
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3d5vzha0.ggd\toolspab1.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3d5vzha0.ggd\toolspab1.exe
                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                            PID:5500
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3d5vzha0.ggd\toolspab1.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3d5vzha0.ggd\toolspab1.exe
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                PID:6444
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\g2gvqzmm.3ro\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:9192
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\g2gvqzmm.3ro\installer.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\g2gvqzmm.3ro\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                  PID:6976
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xiagmbpx.cra\702564a0.exe & exit
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:9664
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\xiagmbpx.cra\702564a0.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\xiagmbpx.cra\702564a0.exe
                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                      PID:2284
                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:5008
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:5180
                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:5152
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:5496
                                                                                                                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 69C8328E30EE1C83DB2628E3A3873B3B C
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:5948
                                                                                                                                                                                                                                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding EAD5FCD688E32227DF9F5A2EC03EF598
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:6652
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                                                                                              PID:4204
                                                                                                                                                                                                                                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 247F013642E94F43B0F6C1B3ED25E083 E Global\MSI0000
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:9148
                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:5792
                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:5072
                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:9048
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:3812
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:9732
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:9932
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:8764
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\76B7.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\76B7.exe
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:9908
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7F73.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7F73.exe
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:4296
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:9600
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:10072
                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:8280

                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                  • memory/204-292-0x00000000056B0000-0x00000000056B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/204-290-0x0000000005380000-0x0000000005381000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/204-289-0x00000000055E0000-0x00000000055E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/204-273-0x0000000000A40000-0x0000000000A41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/204-280-0x00000000053F0000-0x00000000053F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/344-240-0x0000022347B50000-0x0000022347BC0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/412-216-0x0000026D259A0000-0x0000026D25A10000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/840-328-0x0000000000FE0000-0x0000000000FE2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/996-211-0x0000028903C30000-0x0000028903CA0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/996-208-0x0000028903500000-0x000002890354B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    300KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/1172-230-0x0000020298280000-0x00000202982F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/1180-298-0x0000028C5D6B0000-0x0000028C5D720000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/1352-262-0x000001F2F2790000-0x000001F2F2800000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/1376-274-0x00000186BEA00000-0x00000186BEA70000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/1640-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/1640-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    572KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/1640-136-0x0000000000400000-0x000000000051D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    1.1MB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/1640-139-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/1640-138-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/1640-134-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/1640-140-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/1640-135-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    152KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/1964-295-0x0000011193180000-0x00000111931F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/2272-170-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    116KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/2504-217-0x000002978EA40000-0x000002978EAB0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/2540-223-0x0000019891D20000-0x0000019891D90000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/2716-343-0x0000000002AD0000-0x0000000002AE6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    88KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/2796-283-0x000001FE32860000-0x000001FE328D0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/2804-291-0x000002603B7A0000-0x000002603B810000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/2828-188-0x00000000004D0000-0x000000000057E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    696KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/2856-231-0x00000272AB160000-0x00000272AB1D0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/2876-317-0x0000000000530000-0x0000000000539000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    36KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/2876-326-0x0000000000400000-0x000000000044D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    308KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/3440-330-0x0000000000400000-0x00000000004A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    664KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/3440-322-0x00000000020C0000-0x0000000002157000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    604KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/3604-187-0x000000001AEA0000-0x000000001AEA2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/3604-184-0x0000000000760000-0x000000000077B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/3604-174-0x0000000000040000-0x0000000000041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/3884-335-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/3968-225-0x0000000005330000-0x0000000005331000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/3968-176-0x0000000000B40000-0x0000000000B41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4128-183-0x0000000000400000-0x00000000005DF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    1.9MB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4228-350-0x00000000005D0000-0x00000000005FF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    188KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4308-338-0x000001B61AA80000-0x000001B61AAF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    452KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4308-337-0x000001B61A880000-0x000001B61A8CB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    300KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4388-210-0x00000000048A0000-0x00000000048FC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    368KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4388-206-0x000000000494E000-0x0000000004A4F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4488-239-0x00000197BFC50000-0x00000197BFCC0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    448KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4528-236-0x00000000009C0000-0x00000000009C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4752-346-0x0000000007293000-0x0000000007294000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4752-302-0x00000000077F0000-0x00000000077F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4752-271-0x0000000007292000-0x0000000007293000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4752-244-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4752-245-0x0000000007290000-0x0000000007291000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4752-287-0x0000000007730000-0x0000000007731000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4752-251-0x00000000078D0000-0x00000000078D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4752-344-0x000000007ED30000-0x000000007ED31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4752-301-0x0000000008070000-0x0000000008071000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4772-334-0x0000000001100000-0x0000000001102000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4772-340-0x0000000001102000-0x0000000001104000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4772-341-0x0000000001104000-0x0000000001105000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4772-342-0x0000000001105000-0x0000000001107000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4776-319-0x0000000000400000-0x0000000000416000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    88KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4924-263-0x00000000010E0000-0x0000000001109000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4924-243-0x0000000000820000-0x0000000000821000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4924-281-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/4944-305-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/5048-260-0x00000000012E0000-0x00000000012E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/5048-272-0x000000000A7C0000-0x000000000A7C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/5048-275-0x000000000A740000-0x000000000A741000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/5048-265-0x00000000014A0000-0x00000000014AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    56KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/5048-256-0x0000000000A70000-0x0000000000A71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/5048-270-0x000000000ABD0000-0x000000000ABD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/5112-345-0x0000000000DC5000-0x0000000000DC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/5112-339-0x0000000000DC2000-0x0000000000DC4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                  • memory/5112-333-0x0000000000DC0000-0x0000000000DC2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                    Download