Overview

overview

10

Static

static

89807DE693...FD.exe

windows7_x64

10

89807DE693...FD.exe

windows10_x64

10

Analysis

  • max time kernel
    59s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    09/06/2021, 20:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    89807DE693C5D845D463F6DA8990BEFD.exe
  • Size 3.8MB
  • Sample210609-trjxtvvp2a
  • SHA256 3d30ffd438512742fc01ca5df9c4b9d0deb9f908ef56e7dd3e284eec904f517d
  • MD5 SHA1 SHA512
Score
10/10
elysiumstealerraccoonredlinesmokeloadersocelarsvidar890backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

  • vidar

Version

  • 39.3

Botnet

  • 890

C2

  • https://bandakere.tumblr.com

Attributes
  • profile_id

    890

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://ppcspb.com/upload/

  • http://mebbing.com/upload/

  • http://twcamel.com/upload/

  • http://howdycash.com/upload/

  • http://lahuertasonora.com/upload/

  • http://kpotiques.com/upload/

rc4.i32
rc4.i32

Signatures

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

    stealerelysiumstealer
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Vidar Stealer 2 IoCs
    stealer
  • Blocklisted process makes network request 9 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 49 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 36 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • autoit_exe 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Program Files directory 32 IoCs
  • Drops file in Windows directory 24 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
    evasion
  • Kills process with taskkill 4 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Script User-Agent 10 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
    1⤵
      PID:1092
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Themes
      1⤵
        PID:1228
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s UserManager
        1⤵
          PID:1296
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s SENS
          1⤵
            PID:1380
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1836
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
              1⤵
                PID:2388
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                1⤵
                  PID:2368
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Browser
                  1⤵
                    PID:2604
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2700
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                    1⤵
                      PID:2716
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      PID:1044
                      • C:\Users\Admin\AppData\Roaming\bervgdc
                        C:\Users\Admin\AppData\Roaming\bervgdc
                        2⤵
                          PID:7840
                        • C:\Users\Admin\AppData\Roaming\drrvgdc
                          C:\Users\Admin\AppData\Roaming\drrvgdc
                          2⤵
                            PID:6352
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                          1⤵
                            PID:60
                          • C:\Users\Admin\AppData\Local\Temp\89807DE693C5D845D463F6DA8990BEFD.exe
                            "C:\Users\Admin\AppData\Local\Temp\89807DE693C5D845D463F6DA8990BEFD.exe"
                            1⤵
                            • Checks computer location settings
                            • Suspicious use of WriteProcessMemory
                            PID:660
                            • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                              "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:436
                              • C:\Users\Admin\AppData\Roaming\6772078.exe
                                "C:\Users\Admin\AppData\Roaming\6772078.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2736
                              • C:\Users\Admin\AppData\Roaming\3596290.exe
                                "C:\Users\Admin\AppData\Roaming\3596290.exe"
                                3⤵
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Suspicious use of WriteProcessMemory
                                PID:1584
                                • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                  "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  PID:4420
                              • C:\Users\Admin\AppData\Roaming\5856036.exe
                                "C:\Users\Admin\AppData\Roaming\5856036.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1624
                                • C:\Users\Admin\AppData\Roaming\5856036.exe
                                  "{path}"
                                  4⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:4816
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\5856036.exe"
                                    5⤵
                                      PID:6668
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout /T 10 /NOBREAK
                                        6⤵
                                        • Delays execution with timeout.exe
                                        PID:6744
                                • C:\Users\Admin\AppData\Roaming\7697072.exe
                                  "C:\Users\Admin\AppData\Roaming\7697072.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2228
                              • C:\Users\Admin\AppData\Local\Temp\Files.exe
                                "C:\Users\Admin\AppData\Local\Temp\Files.exe"
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of WriteProcessMemory
                                PID:188
                                • C:\Users\Public\run.exe
                                  C:\Users\Public\run.exe
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:4176
                                  • C:\Users\Public\run.exe
                                    C:\Users\Public\run.exe
                                    4⤵
                                    • Executes dropped EXE
                                    PID:4344
                                • C:\Users\Public\run2.exe
                                  C:\Users\Public\run2.exe
                                  3⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks processor information in registry
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4204
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /im run2.exe /f & timeout /t 6 & del /f /q "C:\Users\Public\run2.exe" & del C:\ProgramData\*.dll & exit
                                    4⤵
                                      PID:4644
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /im run2.exe /f
                                        5⤵
                                        • Kills process with taskkill
                                        PID:5280
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout /t 6
                                        5⤵
                                        • Delays execution with timeout.exe
                                        PID:5764
                                • C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
                                  "C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4632
                                • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4656
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /c taskkill /f /im chrome.exe
                                    3⤵
                                      PID:4644
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im chrome.exe
                                        4⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5072
                                  • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Checks computer location settings
                                    • Modifies registry class
                                    • Suspicious use of WriteProcessMemory
                                    PID:4704
                                    • C:\Windows\SysWOW64\rUNdlL32.eXe
                                      "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get
                                      3⤵
                                      • Loads dropped DLL
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:4640
                                  • C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe
                                    "C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4744
                                    • C:\Users\Admin\AppData\Local\Temp\is-G2UUV.tmp\IDWCH1.tmp
                                      "C:\Users\Admin\AppData\Local\Temp\is-G2UUV.tmp\IDWCH1.tmp" /SL5="$1025A,506086,422400,C:\Users\Admin\AppData\Local\Temp\IDWCH1.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of WriteProcessMemory
                                      PID:4876
                                      • C:\Users\Admin\AppData\Local\Temp\is-FLCN1.tmp\è8__________________67.exe
                                        "C:\Users\Admin\AppData\Local\Temp\is-FLCN1.tmp\è8__________________67.exe" /S /UID=124
                                        4⤵
                                        • Drops file in Drivers directory
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Drops file in Program Files directory
                                        PID:4648
                                        • C:\Program Files\Common Files\DMDSHCGLMP\IDownload.exe
                                          "C:\Program Files\Common Files\DMDSHCGLMP\IDownload.exe" /VERYSILENT
                                          5⤵
                                          • Executes dropped EXE
                                          PID:5660
                                          • C:\Users\Admin\AppData\Local\Temp\is-Q48CO.tmp\IDownload.tmp
                                            "C:\Users\Admin\AppData\Local\Temp\is-Q48CO.tmp\IDownload.tmp" /SL5="$50214,994212,425984,C:\Program Files\Common Files\DMDSHCGLMP\IDownload.exe" /VERYSILENT
                                            6⤵
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Suspicious use of FindShellTrayWindow
                                            PID:5728
                                            • C:\Program Files (x86)\IDownload\IDownload.App.exe
                                              "C:\Program Files (x86)\IDownload\IDownload.App.exe" -silent -desktopShortcut -programMenu
                                              7⤵
                                              • Executes dropped EXE
                                              • Drops desktop.ini file(s)
                                              • Drops file in Program Files directory
                                              • Drops file in Windows directory
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              PID:3384
                                              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
                                                "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mbbezcvb.cmdline"
                                                8⤵
                                                  PID:5512
                                                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                                                    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEF77.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEF76.tmp"
                                                    9⤵
                                                      PID:5744
                                            • C:\Users\Admin\AppData\Local\Temp\1b-76991-1c8-20c9f-32e17b8037558\Naenaezhigicy.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1b-76991-1c8-20c9f-32e17b8037558\Naenaezhigicy.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              • Checks computer location settings
                                              PID:5796
                                            • C:\Users\Admin\AppData\Local\Temp\b0-b2223-c6d-244b3-29f9af33d3c62\Gixubakyfy.exe
                                              "C:\Users\Admin\AppData\Local\Temp\b0-b2223-c6d-244b3-29f9af33d3c62\Gixubakyfy.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              PID:1756
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\t3exnlwh.llf\001.exe & exit
                                                6⤵
                                                  PID:6068
                                                  • C:\Users\Admin\AppData\Local\Temp\t3exnlwh.llf\001.exe
                                                    C:\Users\Admin\AppData\Local\Temp\t3exnlwh.llf\001.exe
                                                    7⤵
                                                      PID:4120
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ghkonic4.xdn\GcleanerEU.exe /eufive & exit
                                                    6⤵
                                                      PID:5644
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cno4p130.fjv\installer.exe /qn CAMPAIGN="654" & exit
                                                      6⤵
                                                        PID:5720
                                                        • C:\Users\Admin\AppData\Local\Temp\cno4p130.fjv\installer.exe
                                                          C:\Users\Admin\AppData\Local\Temp\cno4p130.fjv\installer.exe /qn CAMPAIGN="654"
                                                          7⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Enumerates connected drives
                                                          • Modifies system certificate store
                                                          • Suspicious use of FindShellTrayWindow
                                                          PID:4120
                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                            "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\cno4p130.fjv\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\cno4p130.fjv\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1623018979 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                            8⤵
                                                              PID:5972
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fpwhhxaj.4c3\gaoou.exe & exit
                                                          6⤵
                                                            PID:4880
                                                            • C:\Users\Admin\AppData\Local\Temp\fpwhhxaj.4c3\gaoou.exe
                                                              C:\Users\Admin\AppData\Local\Temp\fpwhhxaj.4c3\gaoou.exe
                                                              7⤵
                                                              • Executes dropped EXE
                                                              PID:5464
                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                8⤵
                                                                • Executes dropped EXE
                                                                PID:5492
                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                8⤵
                                                                • Executes dropped EXE
                                                                PID:184
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\n1ypdf1b.dqv\Setup3310.exe /Verysilent /subid=623 & exit
                                                            6⤵
                                                              PID:2340
                                                              • C:\Users\Admin\AppData\Local\Temp\n1ypdf1b.dqv\Setup3310.exe
                                                                C:\Users\Admin\AppData\Local\Temp\n1ypdf1b.dqv\Setup3310.exe /Verysilent /subid=623
                                                                7⤵
                                                                • Executes dropped EXE
                                                                PID:4624
                                                                • C:\Users\Admin\AppData\Local\Temp\is-JF1T6.tmp\Setup3310.tmp
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-JF1T6.tmp\Setup3310.tmp" /SL5="$603F0,138429,56832,C:\Users\Admin\AppData\Local\Temp\n1ypdf1b.dqv\Setup3310.exe" /Verysilent /subid=623
                                                                  8⤵
                                                                    PID:5744
                                                                    • C:\Users\Admin\AppData\Local\Temp\is-H3UCL.tmp\Setup.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\is-H3UCL.tmp\Setup.exe" /Verysilent
                                                                      9⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Program Files directory
                                                                      PID:5608
                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\Aq7KJ3GWvdkS.exe
                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\Aq7KJ3GWvdkS.exe"
                                                                        10⤵
                                                                        • Executes dropped EXE
                                                                        PID:6288
                                                                        • C:\Program Files (x86)\Data Finder\Versium Research\Aq7KJ3GWvdkS.exe
                                                                          "C:\Program Files (x86)\Data Finder\Versium Research\Aq7KJ3GWvdkS.exe"
                                                                          11⤵
                                                                            PID:5064
                                                                        • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                                          "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                                          10⤵
                                                                          • Executes dropped EXE
                                                                          PID:6304
                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                            11⤵
                                                                              PID:6696
                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                              11⤵
                                                                                PID:5456
                                                                            • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                              "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                              10⤵
                                                                              • Executes dropped EXE
                                                                              PID:6340
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                                                11⤵
                                                                                  PID:1724
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    taskkill /im RunWW.exe /f
                                                                                    12⤵
                                                                                    • Kills process with taskkill
                                                                                    PID:4592
                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                    timeout /t 6
                                                                                    12⤵
                                                                                    • Delays execution with timeout.exe
                                                                                    PID:6604
                                                                              • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                                                "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                10⤵
                                                                                • Executes dropped EXE
                                                                                PID:6384
                                                                                • C:\Users\Admin\AppData\Local\Temp\is-NITNC.tmp\lylal220.tmp
                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-NITNC.tmp\lylal220.tmp" /SL5="$304C0,491750,408064,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                  11⤵
                                                                                    PID:6488
                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-UAU94.tmp\56FT____________________.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-UAU94.tmp\56FT____________________.exe" /S /UID=lylal220
                                                                                      12⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:6852
                                                                                      • C:\Program Files\Windows Defender\JUJWAARFLZ\irecord.exe
                                                                                        "C:\Program Files\Windows Defender\JUJWAARFLZ\irecord.exe" /VERYSILENT
                                                                                        13⤵
                                                                                          PID:6952
                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-LKLP8.tmp\irecord.tmp
                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-LKLP8.tmp\irecord.tmp" /SL5="$304CE,6139911,56832,C:\Program Files\Windows Defender\JUJWAARFLZ\irecord.exe" /VERYSILENT
                                                                                            14⤵
                                                                                              PID:6804
                                                                                              • C:\Program Files (x86)\recording\i-record.exe
                                                                                                "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                                                                                15⤵
                                                                                                  PID:4980
                                                                                            • C:\Users\Admin\AppData\Local\Temp\5f-28600-401-e9d88-932bdf37781fd\SHaewiqyfyzha.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\5f-28600-401-e9d88-932bdf37781fd\SHaewiqyfyzha.exe"
                                                                                              13⤵
                                                                                                PID:4888
                                                                                              • C:\Users\Admin\AppData\Local\Temp\f2-3b939-a38-0c493-d6c61e561b7d8\ZHituhidaewy.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\f2-3b939-a38-0c493-d6c61e561b7d8\ZHituhidaewy.exe"
                                                                                                13⤵
                                                                                                  PID:508
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\42s4iloq.l3f\001.exe & exit
                                                                                                    14⤵
                                                                                                      PID:6888
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42s4iloq.l3f\001.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\42s4iloq.l3f\001.exe
                                                                                                        15⤵
                                                                                                          PID:4328
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\r3ruhspq.5i1\GcleanerEU.exe /eufive & exit
                                                                                                        14⤵
                                                                                                          PID:4380
                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                            15⤵
                                                                                                              PID:4220
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3qylkhwb.r4l\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                            14⤵
                                                                                                              PID:6624
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3qylkhwb.r4l\installer.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\3qylkhwb.r4l\installer.exe /qn CAMPAIGN="654"
                                                                                                                15⤵
                                                                                                                  PID:6880
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\n5xk0dx4.pzl\gaoou.exe & exit
                                                                                                                14⤵
                                                                                                                  PID:6732
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\n5xk0dx4.pzl\gaoou.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\n5xk0dx4.pzl\gaoou.exe
                                                                                                                    15⤵
                                                                                                                      PID:4620
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                        16⤵
                                                                                                                          PID:4680
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                          16⤵
                                                                                                                            PID:6260
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bagxfpg2.1bw\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                        14⤵
                                                                                                                        • Blocklisted process makes network request
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                        PID:5744
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bagxfpg2.1bw\Setup3310.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\bagxfpg2.1bw\Setup3310.exe /Verysilent /subid=623
                                                                                                                          15⤵
                                                                                                                            PID:4484
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-JU6QS.tmp\Setup3310.tmp
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-JU6QS.tmp\Setup3310.tmp" /SL5="$105F6,138429,56832,C:\Users\Admin\AppData\Local\Temp\bagxfpg2.1bw\Setup3310.exe" /Verysilent /subid=623
                                                                                                                              16⤵
                                                                                                                                PID:6428
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-0L363.tmp\Setup.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-0L363.tmp\Setup.exe" /Verysilent
                                                                                                                                  17⤵
                                                                                                                                    PID:7252
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5cpqiacf.s1l\google-game.exe & exit
                                                                                                                              14⤵
                                                                                                                                PID:6116
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5cpqiacf.s1l\google-game.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\5cpqiacf.s1l\google-game.exe
                                                                                                                                  15⤵
                                                                                                                                    PID:6036
                                                                                                                                    • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                      "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get
                                                                                                                                      16⤵
                                                                                                                                        PID:7324
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gs3hx1uc.ldu\GcleanerWW.exe /mixone & exit
                                                                                                                                    14⤵
                                                                                                                                      PID:7244
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fzuu1yid.5cf\005.exe & exit
                                                                                                                                      14⤵
                                                                                                                                        PID:7384
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fzuu1yid.5cf\005.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\fzuu1yid.5cf\005.exe
                                                                                                                                          15⤵
                                                                                                                                            PID:7628
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\out50sua.nsc\toolspab1.exe & exit
                                                                                                                                          14⤵
                                                                                                                                            PID:7836
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\out50sua.nsc\toolspab1.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\out50sua.nsc\toolspab1.exe
                                                                                                                                              15⤵
                                                                                                                                                PID:8004
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\out50sua.nsc\toolspab1.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\out50sua.nsc\toolspab1.exe
                                                                                                                                                  16⤵
                                                                                                                                                    PID:8188
                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ulpovnu0.iyg\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                14⤵
                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:6488
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ulpovnu0.iyg\installer.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\ulpovnu0.iyg\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                  15⤵
                                                                                                                                                    PID:5584
                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2rwtlsi1.v54\702564a0.exe & exit
                                                                                                                                                  14⤵
                                                                                                                                                    PID:7136
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2rwtlsi1.v54\702564a0.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2rwtlsi1.v54\702564a0.exe
                                                                                                                                                      15⤵
                                                                                                                                                        PID:6816
                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 6816 -s 476
                                                                                                                                                          16⤵
                                                                                                                                                          • Program crash
                                                                                                                                                          PID:4856
                                                                                                                                            • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                                                                              "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                              10⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:6416
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-88DBH.tmp\LabPicV3.tmp
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-88DBH.tmp\LabPicV3.tmp" /SL5="$304E2,506086,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                11⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:6480
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-TJAGV.tmp\_____________.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-TJAGV.tmp\_____________.exe" /S /UID=lab214
                                                                                                                                                  12⤵
                                                                                                                                                    PID:6860
                                                                                                                                                    • C:\Program Files\Windows Multimedia Platform\XVXDIXNBED\prolab.exe
                                                                                                                                                      "C:\Program Files\Windows Multimedia Platform\XVXDIXNBED\prolab.exe" /VERYSILENT
                                                                                                                                                      13⤵
                                                                                                                                                        PID:6916
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-VPTRD.tmp\prolab.tmp
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-VPTRD.tmp\prolab.tmp" /SL5="$302C6,575243,216576,C:\Program Files\Windows Multimedia Platform\XVXDIXNBED\prolab.exe" /VERYSILENT
                                                                                                                                                          14⤵
                                                                                                                                                            PID:6988
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\a2-12fcd-64f-16baf-be5ec30011231\Famaemycishae.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\a2-12fcd-64f-16baf-be5ec30011231\Famaemycishae.exe"
                                                                                                                                                          13⤵
                                                                                                                                                            PID:7060
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\cf-2170c-4d9-36e9f-9ead7066136b7\Lubaecowaesa.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\cf-2170c-4d9-36e9f-9ead7066136b7\Lubaecowaesa.exe"
                                                                                                                                                            13⤵
                                                                                                                                                              PID:6836
                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\54mwawsz.5jl\001.exe & exit
                                                                                                                                                                14⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:6696
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\54mwawsz.5jl\001.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\54mwawsz.5jl\001.exe
                                                                                                                                                                  15⤵
                                                                                                                                                                    PID:6936
                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sgzxggqp.ayb\GcleanerEU.exe /eufive & exit
                                                                                                                                                                  14⤵
                                                                                                                                                                    PID:5468
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\o0tgbbef.k1g\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                    14⤵
                                                                                                                                                                      PID:4384
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\o0tgbbef.k1g\installer.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\o0tgbbef.k1g\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                        15⤵
                                                                                                                                                                          PID:6444
                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\njtqh51x.lkm\gaoou.exe & exit
                                                                                                                                                                        14⤵
                                                                                                                                                                          PID:7148
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\njtqh51x.lkm\gaoou.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\njtqh51x.lkm\gaoou.exe
                                                                                                                                                                            15⤵
                                                                                                                                                                              PID:3312
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                16⤵
                                                                                                                                                                                  PID:6432
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                  16⤵
                                                                                                                                                                                    PID:6192
                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sjoauw5u.s0s\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                14⤵
                                                                                                                                                                                  PID:6684
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\sjoauw5u.s0s\Setup3310.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\sjoauw5u.s0s\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                    15⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:6860
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-LNFRE.tmp\Setup3310.tmp
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-LNFRE.tmp\Setup3310.tmp" /SL5="$405D4,138429,56832,C:\Users\Admin\AppData\Local\Temp\sjoauw5u.s0s\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                      16⤵
                                                                                                                                                                                        PID:6432
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-UBGLL.tmp\Setup.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-UBGLL.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                          17⤵
                                                                                                                                                                                            PID:8072
                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bssczolq.z4b\google-game.exe & exit
                                                                                                                                                                                      14⤵
                                                                                                                                                                                        PID:6492
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bssczolq.z4b\google-game.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\bssczolq.z4b\google-game.exe
                                                                                                                                                                                          15⤵
                                                                                                                                                                                            PID:6260
                                                                                                                                                                                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get
                                                                                                                                                                                              16⤵
                                                                                                                                                                                                PID:7720
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7720 -s 596
                                                                                                                                                                                                  17⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:7868
                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uxra01q5.3hv\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                            14⤵
                                                                                                                                                                                              PID:7408
                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zftr5qwx.fbr\005.exe & exit
                                                                                                                                                                                              14⤵
                                                                                                                                                                                                PID:7668
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\zftr5qwx.fbr\005.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\zftr5qwx.fbr\005.exe
                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                    PID:7808
                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\z1of532x.psu\toolspab1.exe & exit
                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                    PID:7916
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\z1of532x.psu\toolspab1.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\z1of532x.psu\toolspab1.exe
                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                        PID:7996
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\z1of532x.psu\toolspab1.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\z1of532x.psu\toolspab1.exe
                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                            PID:4272
                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hxcjgjof.zwv\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                          PID:3188
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hxcjgjof.zwv\installer.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\hxcjgjof.zwv\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                            15⤵
                                                                                                                                                                                                              PID:5064
                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\d0e5cmtb.owh\702564a0.exe & exit
                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                              PID:8144
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\d0e5cmtb.owh\702564a0.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\d0e5cmtb.owh\702564a0.exe
                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                  PID:6720
                                                                                                                                                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                        PID:6364
                                                                                                                                                                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                          PID:6844
                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5ljnxbub.uez\google-game.exe & exit
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:4968
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5ljnxbub.uez\google-game.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\5ljnxbub.uez\google-game.exe
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                    PID:1624
                                                                                                                                                                                                    • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                                                      "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get
                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      PID:5424
                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sj2te4f5.wqp\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:5252
                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\np0xeceo.ffa\005.exe & exit
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:4220
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\np0xeceo.ffa\005.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\np0xeceo.ffa\005.exe
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:6212
                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ymycq1s5.wxh\toolspab1.exe & exit
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:6400
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ymycq1s5.wxh\toolspab1.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\ymycq1s5.wxh\toolspab1.exe
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                          PID:6616
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ymycq1s5.wxh\toolspab1.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\ymycq1s5.wxh\toolspab1.exe
                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                            PID:6964
                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fsb0uhia.31m\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:7376
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fsb0uhia.31m\installer.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\fsb0uhia.31m\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                              PID:7620
                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vhn2ervg.nd1\702564a0.exe & exit
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:4672
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\vhn2ervg.nd1\702564a0.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\vhn2ervg.nd1\702564a0.exe
                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                  PID:8068
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                        PID:4792
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\pzyh.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                        PID:4768
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:5048
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                          PID:4716
                                                                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                      PID:356
                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:4708
                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:5852
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                      PID:1176
                                                                                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                      PID:3200
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                      PID:3632
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      PID:3728
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      PID:5516
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                      PID:6120
                                                                                                                                                                                                    • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                      C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:5160
                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 3AE80E8E8C8042370EA373D6CC549C99 C
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                        PID:4644
                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding A53D8370792F89F765E0F28324AFF793
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                        PID:5808
                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                          "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                          PID:4396
                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 010BE46A00D6985BAF7C3DAE4743850C E Global\MSI0000
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                        PID:6808
                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:5936
                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:5404
                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:188
                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:7568
                                                                                                                                                                                                            • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                              C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:6752
                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:4532
                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:4632
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57B1.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\57B1.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:3200
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\78F6.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\78F6.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:5144
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7E85.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7E85.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:5988
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:4536
                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                            C:\Windows\explorer.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:5264
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:4724
                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                C:\Windows\explorer.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:6368
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                  C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:8036
                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                    C:\Windows\explorer.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:4812
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:4560
                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                        C:\Windows\explorer.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:6616
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:1512

                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                memory/60-246-0x0000028951A60000-0x0000028951AD0000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/60-243-0x00000289519A0000-0x00000289519EB000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/356-263-0x0000028B83AD0000-0x0000028B83B40000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/436-121-0x0000000000970000-0x0000000000971000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/436-125-0x000000001B720000-0x000000001B722000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/436-123-0x0000000000E80000-0x0000000000E9B000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1044-274-0x0000012700510000-0x0000012700580000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1092-264-0x00000265F7700000-0x00000265F7770000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1228-284-0x0000020D98540000-0x0000020D985B0000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1296-286-0x000001929F660000-0x000001929F6D0000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1380-276-0x000001C362470000-0x000001C3624E0000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1584-162-0x0000000002760000-0x0000000002761000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1584-143-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1584-133-0x0000000000450000-0x0000000000451000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1584-147-0x0000000000E10000-0x0000000000E1E000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1584-149-0x0000000009610000-0x0000000009611000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1624-185-0x0000000008330000-0x0000000008332000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1624-163-0x0000000004D40000-0x0000000004D41000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1624-166-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1624-139-0x00000000002C0000-0x00000000002C1000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1624-157-0x0000000004D50000-0x0000000004D51000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1624-186-0x00000000083E0000-0x00000000083E1000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1756-327-0x0000000001100000-0x0000000001102000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1756-328-0x0000000001102000-0x0000000001104000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1756-330-0x0000000001104000-0x0000000001105000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1836-282-0x000002B6DE8B0000-0x000002B6DE920000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/1964-295-0x0000000004D70000-0x0000000004D86000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/2228-182-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/2228-165-0x0000000004E70000-0x0000000004EA9000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/2228-168-0x000000000B7F0000-0x000000000B7F1000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/2228-146-0x00000000006C0000-0x00000000006C1000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/2228-150-0x0000000004E60000-0x0000000004E61000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/2368-252-0x000001B8B0BA0000-0x000001B8B0C10000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/2388-257-0x0000015BBB140000-0x0000015BBB1B0000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/2604-240-0x0000029CE8300000-0x0000029CE8370000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/2700-288-0x0000028873E30000-0x0000028873EA0000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/2716-290-0x000001E9E0F00000-0x000001E9E0F70000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/2736-132-0x0000000000C00000-0x0000000000C01000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/2736-187-0x0000000008810000-0x0000000008811000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/2736-141-0x0000000005340000-0x0000000005341000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/2736-151-0x0000000007AD0000-0x0000000007AF9000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/3384-339-0x0000000002344000-0x0000000002345000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/3384-340-0x0000000002345000-0x0000000002346000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/3384-343-0x0000000002346000-0x0000000002348000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/3384-335-0x0000000002342000-0x0000000002344000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/3384-326-0x0000000002340000-0x0000000002342000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4120-337-0x00000000004C0000-0x000000000060A000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4120-336-0x00000000001F0000-0x0000000000200000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4176-170-0x0000000003010000-0x0000000003011000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4176-161-0x0000000000D00000-0x0000000000D01000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4176-180-0x0000000005740000-0x0000000005741000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4204-219-0x0000000000400000-0x000000000049F000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4204-218-0x0000000001FE0000-0x0000000002077000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4344-305-0x0000000004970000-0x0000000004971000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4420-188-0x00000000059A0000-0x00000000059A1000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4632-262-0x0000000003760000-0x0000000003770000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4632-199-0x0000000000400000-0x00000000005DD000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4640-247-0x00000000042F0000-0x000000000434C000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4640-238-0x00000000043F1000-0x00000000044F2000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4648-273-0x0000000003050000-0x0000000003052000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4708-245-0x0000029DFA3D0000-0x0000029DFA440000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4744-201-0x0000000000400000-0x000000000046D000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4792-256-0x0000000000400000-0x0000000000446000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4792-251-0x0000000000450000-0x00000000004FE000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/4876-214-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/5512-332-0x0000000000CB0000-0x0000000000CB2000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/5660-311-0x0000000000400000-0x000000000046E000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/5728-312-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/5796-325-0x0000000002A70000-0x0000000002A72000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/5852-301-0x000002758A570000-0x000002758A5E1000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/5852-348-0x000002758BE60000-0x000002758BE7A000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/5852-300-0x000002758A2A0000-0x000002758A2EB000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/5852-346-0x000002758CB00000-0x000002758CC06000-memory.dmp
                                                                                                                                                                                                                                                Download