Analysis

  • max time kernel
    20s
  • max time network
    159s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    07/09/2021, 17:22

General

  • Target
    C558ED2C819717303C17F6BBD048CF4A.exe
  • Size 2.1MB
  • Sample210907-vxkpragcbp
  • SHA256 d0ed9b5279618e628f62a80cd1abdd208bdd3899cb6865b51591478ca03e46c6
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • vidar

Version
  • 40.4

Botnet
  • 706

C2
  • https://romkaxarit.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family
  • redline

Botnet
  • pub

C2
  • 193.56.146.78:51487

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 7 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 12 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 17 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 8 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2632
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
      1⤵
        PID:64
      • C:\Users\Admin\AppData\Local\Temp\C558ED2C819717303C17F6BBD048CF4A.exe
        "C:\Users\Admin\AppData\Local\Temp\C558ED2C819717303C17F6BBD048CF4A.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:632
        • C:\Users\Admin\AppData\Local\Temp\7zS872E65B4\setup_install.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS872E65B4\setup_install.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:4088
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3580
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3136
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Fri2283a715835d.exe
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2652
            • C:\Users\Admin\AppData\Local\Temp\7zS872E65B4\Fri2283a715835d.exe
              Fri2283a715835d.exe
              4⤵
              • Executes dropped EXE
              PID:3084
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Fri22fb4ed88b9.exe
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1332
            • C:\Users\Admin\AppData\Local\Temp\7zS872E65B4\Fri22fb4ed88b9.exe
              Fri22fb4ed88b9.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4084
              • C:\Users\Admin\AppData\Local\Temp\is-9VBGO.tmp\Fri22fb4ed88b9.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-9VBGO.tmp\Fri22fb4ed88b9.tmp" /SL5="$6004C,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS872E65B4\Fri22fb4ed88b9.exe"
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:3972
                • C:\Users\Admin\AppData\Local\Temp\is-IBJB7.tmp\zab2our.exe
                  "C:\Users\Admin\AppData\Local\Temp\is-IBJB7.tmp\zab2our.exe" /S /UID=burnerch2
                  6⤵
                  • Executes dropped EXE
                  PID:4280
                  • C:\Program Files\VideoLAN\LOXIUFZVLJ\ultramediaburner.exe
                    "C:\Program Files\VideoLAN\LOXIUFZVLJ\ultramediaburner.exe" /VERYSILENT
                    7⤵
                      PID:4244
                      • C:\Users\Admin\AppData\Local\Temp\is-EIBDQ.tmp\ultramediaburner.tmp
                        "C:\Users\Admin\AppData\Local\Temp\is-EIBDQ.tmp\ultramediaburner.tmp" /SL5="$3026E,281924,62464,C:\Program Files\VideoLAN\LOXIUFZVLJ\ultramediaburner.exe" /VERYSILENT
                        8⤵
                          PID:4136
                          • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                            "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                            9⤵
                              PID:4972
                        • C:\Users\Admin\AppData\Local\Temp\17-71bf6-1b9-67da7-53301cb0f013f\Vavaedehabe.exe
                          "C:\Users\Admin\AppData\Local\Temp\17-71bf6-1b9-67da7-53301cb0f013f\Vavaedehabe.exe"
                          7⤵
                            PID:4884
                          • C:\Users\Admin\AppData\Local\Temp\cf-3e40d-24a-838ac-18ce473c73558\Rohocekosy.exe
                            "C:\Users\Admin\AppData\Local\Temp\cf-3e40d-24a-838ac-18ce473c73558\Rohocekosy.exe"
                            7⤵
                              PID:4936
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2hhijjvk.ghk\GcleanerEU.exe /eufive & exit
                                8⤵
                                  PID:3728
                                  • C:\Users\Admin\AppData\Local\Temp\2hhijjvk.ghk\GcleanerEU.exe
                                    C:\Users\Admin\AppData\Local\Temp\2hhijjvk.ghk\GcleanerEU.exe /eufive
                                    9⤵
                                    • Executes dropped EXE
                                    PID:4068
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 648
                                      10⤵
                                      • Program crash
                                      PID:5944
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 660
                                      10⤵
                                      • Program crash
                                      PID:6000
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 772
                                      10⤵
                                      • Program crash
                                      PID:5204
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 808
                                      10⤵
                                      • Program crash
                                      PID:5432
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 1116
                                      10⤵
                                      • Program crash
                                      PID:6944
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yjwtmzur.jcm\installer.exe /qn CAMPAIGN="654" & exit
                                  8⤵
                                    PID:4348
                                    • C:\Users\Admin\AppData\Local\Temp\yjwtmzur.jcm\installer.exe
                                      C:\Users\Admin\AppData\Local\Temp\yjwtmzur.jcm\installer.exe /qn CAMPAIGN="654"
                                      9⤵
                                        PID:4556
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\laz1ql0m.1co\anyname.exe & exit
                                      8⤵
                                        PID:4536
                                        • C:\Users\Admin\AppData\Local\Temp\laz1ql0m.1co\anyname.exe
                                          C:\Users\Admin\AppData\Local\Temp\laz1ql0m.1co\anyname.exe
                                          9⤵
                                            PID:4284
                                            • C:\Users\Admin\AppData\Local\Temp\laz1ql0m.1co\anyname.exe
                                              "C:\Users\Admin\AppData\Local\Temp\laz1ql0m.1co\anyname.exe" -u
                                              10⤵
                                                PID:5176
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yrn3qaed.frt\bumperWW1.exe & exit
                                            8⤵
                                              PID:5212
                                              • C:\Users\Admin\AppData\Local\Temp\yrn3qaed.frt\bumperWW1.exe
                                                C:\Users\Admin\AppData\Local\Temp\yrn3qaed.frt\bumperWW1.exe
                                                9⤵
                                                  PID:5416
                                                  • C:\Users\Admin\Documents\Rmd_A1Yixgphi2jht3qbgJrE.exe
                                                    "C:\Users\Admin\Documents\Rmd_A1Yixgphi2jht3qbgJrE.exe"
                                                    10⤵
                                                      PID:5500
                                                    • C:\Users\Admin\Documents\O27Dh_8p8vTOW0ZgcXE8XqSW.exe
                                                      "C:\Users\Admin\Documents\O27Dh_8p8vTOW0ZgcXE8XqSW.exe"
                                                      10⤵
                                                        PID:5348
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                          11⤵
                                                            PID:7792
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                              12⤵
                                                                PID:7856
                                                          • C:\Users\Admin\Documents\EX1Z9NvTcMUEx6VzrOidZI9K.exe
                                                            "C:\Users\Admin\Documents\EX1Z9NvTcMUEx6VzrOidZI9K.exe"
                                                            10⤵
                                                              PID:5660
                                                            • C:\Users\Admin\Documents\Kvgwvv7Mxv4IRoLlIiwQvZf1.exe
                                                              "C:\Users\Admin\Documents\Kvgwvv7Mxv4IRoLlIiwQvZf1.exe"
                                                              10⤵
                                                                PID:5396
                                                              • C:\Users\Admin\Documents\cxh7goubdK2ZIDI6nTMt0FLh.exe
                                                                "C:\Users\Admin\Documents\cxh7goubdK2ZIDI6nTMt0FLh.exe"
                                                                10⤵
                                                                  PID:5644
                                                                • C:\Users\Admin\Documents\dflNgsaFeEDlkKaxFSeiSa6Z.exe
                                                                  "C:\Users\Admin\Documents\dflNgsaFeEDlkKaxFSeiSa6Z.exe"
                                                                  10⤵
                                                                    PID:5048
                                                                  • C:\Users\Admin\Documents\wXRBoji6I8d_D5PEZA6Lif42.exe
                                                                    "C:\Users\Admin\Documents\wXRBoji6I8d_D5PEZA6Lif42.exe"
                                                                    10⤵
                                                                      PID:204
                                                                    • C:\Users\Admin\Documents\VoVcpYIB14GZXhz_PRzhhJtc.exe
                                                                      "C:\Users\Admin\Documents\VoVcpYIB14GZXhz_PRzhhJtc.exe"
                                                                      10⤵
                                                                        PID:6016
                                                                      • C:\Users\Admin\Documents\B9bQIy4x1QlOmLxRcmT9uR7m.exe
                                                                        "C:\Users\Admin\Documents\B9bQIy4x1QlOmLxRcmT9uR7m.exe"
                                                                        10⤵
                                                                          PID:5324
                                                                          • C:\Windows\SysWOW64\dllhost.exe
                                                                            dllhost.exe
                                                                            11⤵
                                                                              PID:2868
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd /c cmd < Nobile.docm
                                                                              11⤵
                                                                                PID:5012
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  cmd
                                                                                  12⤵
                                                                                    PID:6548
                                                                                    • C:\Windows\SysWOW64\findstr.exe
                                                                                      findstr /V /R "^mFzuIhvmvbdHpfegBQvdRBWtkZruqmiMQZvPfzkmbfdsclZwZBnIIvmXJgVJldnWdERlThYiFXSCkFJqZwimwmrxmnuwnBfiQxqRzPi$" Vederlo.docm
                                                                                      13⤵
                                                                                        PID:7564
                                                                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rimasta.exe.com
                                                                                        Rimasta.exe.com J
                                                                                        13⤵
                                                                                          PID:7448
                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rimasta.exe.com
                                                                                            C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rimasta.exe.com J
                                                                                            14⤵
                                                                                              PID:3380
                                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                                            ping localhost
                                                                                            13⤵
                                                                                            • Runs ping.exe
                                                                                            PID:7444
                                                                                    • C:\Users\Admin\Documents\jFpiBbX5vZm7xyIqnK9XNY8x.exe
                                                                                      "C:\Users\Admin\Documents\jFpiBbX5vZm7xyIqnK9XNY8x.exe"
                                                                                      10⤵
                                                                                        PID:5692
                                                                                      • C:\Users\Admin\Documents\rhR5aYwxyvOobdERU0rVM8oM.exe
                                                                                        "C:\Users\Admin\Documents\rhR5aYwxyvOobdERU0rVM8oM.exe"
                                                                                        10⤵
                                                                                          PID:808
                                                                                          • C:\ProgramData\8724717.exe
                                                                                            "C:\ProgramData\8724717.exe"
                                                                                            11⤵
                                                                                              PID:8040
                                                                                            • C:\ProgramData\7453388.exe
                                                                                              "C:\ProgramData\7453388.exe"
                                                                                              11⤵
                                                                                                PID:8072
                                                                                              • C:\ProgramData\6715913.exe
                                                                                                "C:\ProgramData\6715913.exe"
                                                                                                11⤵
                                                                                                  PID:7648
                                                                                              • C:\Users\Admin\Documents\D6ThVBELAHLerAy3FtCWafwe.exe
                                                                                                "C:\Users\Admin\Documents\D6ThVBELAHLerAy3FtCWafwe.exe"
                                                                                                10⤵
                                                                                                  PID:4052
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{3C70FEB2-36A7-4813-8D51-FCE8EDF5DC8B}\D6ThVBELAHLerAy3FtCWafwe.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\{3C70FEB2-36A7-4813-8D51-FCE8EDF5DC8B}\D6ThVBELAHLerAy3FtCWafwe.exe /q"C:\Users\Admin\Documents\D6ThVBELAHLerAy3FtCWafwe.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{3C70FEB2-36A7-4813-8D51-FCE8EDF5DC8B}" /IS_temp
                                                                                                    11⤵
                                                                                                      PID:4872
                                                                                                      • C:\Windows\SysWOW64\MSIEXEC.EXE
                                                                                                        "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{8A5BF57D-B59D-4179-805E-5B79EEC8A2B8}\menageudrivers.msi" SETUPEXEDIR="C:\Users\Admin\Documents" SETUPEXENAME="D6ThVBELAHLerAy3FtCWafwe.exe"
                                                                                                        12⤵
                                                                                                          PID:7480
                                                                                                    • C:\Users\Admin\Documents\qyKqsZO38VaMAmExjO3LbAUb.exe
                                                                                                      "C:\Users\Admin\Documents\qyKqsZO38VaMAmExjO3LbAUb.exe"
                                                                                                      10⤵
                                                                                                        PID:2812
                                                                                                        • C:\Users\Admin\Documents\qyKqsZO38VaMAmExjO3LbAUb.exe
                                                                                                          "C:\Users\Admin\Documents\qyKqsZO38VaMAmExjO3LbAUb.exe" -u
                                                                                                          11⤵
                                                                                                            PID:6076
                                                                                                        • C:\Users\Admin\Documents\MOi6csML3I5AkT72xKC6Jski.exe
                                                                                                          "C:\Users\Admin\Documents\MOi6csML3I5AkT72xKC6Jski.exe"
                                                                                                          10⤵
                                                                                                            PID:4268
                                                                                                          • C:\Users\Admin\Documents\RKnmpPRTUgTerGswOuahf1HQ.exe
                                                                                                            "C:\Users\Admin\Documents\RKnmpPRTUgTerGswOuahf1HQ.exe"
                                                                                                            10⤵
                                                                                                              PID:5156
                                                                                                              • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                                                11⤵
                                                                                                                  PID:7688
                                                                                                                • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                                                                                  "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                                                                                                  11⤵
                                                                                                                    PID:7680
                                                                                                                  • C:\Program Files (x86)\Company\NewProduct\inst001.exe
                                                                                                                    "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
                                                                                                                    11⤵
                                                                                                                      PID:7672
                                                                                                                  • C:\Users\Admin\Documents\NHFFiSUeFNnMEiAos2lVXkyt.exe
                                                                                                                    "C:\Users\Admin\Documents\NHFFiSUeFNnMEiAos2lVXkyt.exe"
                                                                                                                    10⤵
                                                                                                                      PID:6028
                                                                                                                    • C:\Users\Admin\Documents\YpfllBQg396ssf4zkLBQrISr.exe
                                                                                                                      "C:\Users\Admin\Documents\YpfllBQg396ssf4zkLBQrISr.exe"
                                                                                                                      10⤵
                                                                                                                        PID:5952
                                                                                                                      • C:\Users\Admin\Documents\rlxpnWs6F2vkkAFcmh2GbrCl.exe
                                                                                                                        "C:\Users\Admin\Documents\rlxpnWs6F2vkkAFcmh2GbrCl.exe"
                                                                                                                        10⤵
                                                                                                                          PID:5932
                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                            "C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL"). Run ( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\rlxpnWs6F2vkkAFcmh2GbrCl.exe"" > X4d4XArNWDu.eXE && StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """" == """" for %A IN ( ""C:\Users\Admin\Documents\rlxpnWs6F2vkkAFcmh2GbrCl.exe"" ) do taskkill /f -im ""%~nxA"" " , 0 , trUE ) )
                                                                                                                            11⤵
                                                                                                                              PID:7624
                                                                                                                          • C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                            "C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe"
                                                                                                                            10⤵
                                                                                                                              PID:5916
                                                                                                                              • C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                11⤵
                                                                                                                                  PID:6488
                                                                                                                                • C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                  C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                  11⤵
                                                                                                                                    PID:6776
                                                                                                                                  • C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                    C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                    11⤵
                                                                                                                                      PID:6192
                                                                                                                                    • C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                      C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                      11⤵
                                                                                                                                        PID:6540
                                                                                                                                      • C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                        C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                        11⤵
                                                                                                                                          PID:6720
                                                                                                                                        • C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                          C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                          11⤵
                                                                                                                                            PID:5060
                                                                                                                                          • C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                            C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                            11⤵
                                                                                                                                              PID:5904
                                                                                                                                            • C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                              C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                              11⤵
                                                                                                                                                PID:6884
                                                                                                                                              • C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                                C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                                11⤵
                                                                                                                                                  PID:5144
                                                                                                                                                • C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                                  C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                                  11⤵
                                                                                                                                                    PID:7512
                                                                                                                                                  • C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                                    C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                                    11⤵
                                                                                                                                                      PID:7920
                                                                                                                                                    • C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                                      C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                                      11⤵
                                                                                                                                                        PID:7256
                                                                                                                                                      • C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                                        C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                                        11⤵
                                                                                                                                                          PID:7872
                                                                                                                                                        • C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                                          C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                                          11⤵
                                                                                                                                                            PID:7364
                                                                                                                                                          • C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                                            C:\Users\Admin\Documents\SCg6GMFsN89MYlr5DdvfQ9Lw.exe
                                                                                                                                                            11⤵
                                                                                                                                                              PID:8008
                                                                                                                                                          • C:\Users\Admin\Documents\YRnisn0h2G0rnl7yoOYrJDVV.exe
                                                                                                                                                            "C:\Users\Admin\Documents\YRnisn0h2G0rnl7yoOYrJDVV.exe"
                                                                                                                                                            10⤵
                                                                                                                                                              PID:5900
                                                                                                                                                            • C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                              "C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe"
                                                                                                                                                              10⤵
                                                                                                                                                                PID:5884
                                                                                                                                                                • C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                  C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                  11⤵
                                                                                                                                                                    PID:6440
                                                                                                                                                                  • C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                    C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                    11⤵
                                                                                                                                                                      PID:6644
                                                                                                                                                                    • C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                      C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                      11⤵
                                                                                                                                                                        PID:7076
                                                                                                                                                                      • C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                        C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                        11⤵
                                                                                                                                                                          PID:6436
                                                                                                                                                                        • C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                          C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                          11⤵
                                                                                                                                                                            PID:6788
                                                                                                                                                                          • C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                            C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                            11⤵
                                                                                                                                                                              PID:6272
                                                                                                                                                                            • C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                              C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                              11⤵
                                                                                                                                                                                PID:6940
                                                                                                                                                                              • C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                                C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                                11⤵
                                                                                                                                                                                  PID:6384
                                                                                                                                                                                • C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                                  C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                                  11⤵
                                                                                                                                                                                    PID:4392
                                                                                                                                                                                  • C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                                    C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                                    11⤵
                                                                                                                                                                                      PID:7364
                                                                                                                                                                                    • C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                                      C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                                      11⤵
                                                                                                                                                                                        PID:7736
                                                                                                                                                                                      • C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                                        C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                                        11⤵
                                                                                                                                                                                          PID:8084
                                                                                                                                                                                        • C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                                          C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                                          11⤵
                                                                                                                                                                                            PID:4924
                                                                                                                                                                                          • C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                                            C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                                            11⤵
                                                                                                                                                                                              PID:7584
                                                                                                                                                                                            • C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                                              C:\Users\Admin\Documents\KpjHwBDyqy4lSIHxC3bOeu9w.exe
                                                                                                                                                                                              11⤵
                                                                                                                                                                                                PID:7424
                                                                                                                                                                                            • C:\Users\Admin\Documents\nEQcGwX0KiJxi1LigcyctYFa.exe
                                                                                                                                                                                              "C:\Users\Admin\Documents\nEQcGwX0KiJxi1LigcyctYFa.exe"
                                                                                                                                                                                              10⤵
                                                                                                                                                                                                PID:5584
                                                                                                                                                                                              • C:\Users\Admin\Documents\zAeRvp6kPLSUHT0PKdK3dZTc.exe
                                                                                                                                                                                                "C:\Users\Admin\Documents\zAeRvp6kPLSUHT0PKdK3dZTc.exe"
                                                                                                                                                                                                10⤵
                                                                                                                                                                                                  PID:5592
                                                                                                                                                                                                  • C:\Users\Admin\Documents\zAeRvp6kPLSUHT0PKdK3dZTc.exe
                                                                                                                                                                                                    "C:\Users\Admin\Documents\zAeRvp6kPLSUHT0PKdK3dZTc.exe"
                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                      PID:6504
                                                                                                                                                                                                  • C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                    "C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe"
                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                      PID:5668
                                                                                                                                                                                                      • C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                        C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                          PID:6468
                                                                                                                                                                                                        • C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                          C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                            PID:6656
                                                                                                                                                                                                          • C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                            C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                              PID:7140
                                                                                                                                                                                                            • C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                              C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                PID:5332
                                                                                                                                                                                                              • C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                  PID:6900
                                                                                                                                                                                                                • C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                  C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                    PID:6340
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                    C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                      PID:196
                                                                                                                                                                                                                    • C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                      C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                        PID:6132
                                                                                                                                                                                                                      • C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                        C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                          PID:5996
                                                                                                                                                                                                                        • C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                          C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                            PID:7404
                                                                                                                                                                                                                          • C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                            C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                              PID:7768
                                                                                                                                                                                                                            • C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                              C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                PID:8160
                                                                                                                                                                                                                              • C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                                C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                  PID:7752
                                                                                                                                                                                                                                • C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                                  C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                    PID:4952
                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                                    C:\Users\Admin\Documents\WnkAPn66vaEFrK8zIHZ59zBQ.exe
                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                      PID:7752
                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\Ps9Eb0sfVMCXR1FU9_g9iFBm.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\Ps9Eb0sfVMCXR1FU9_g9iFBm.exe"
                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                      PID:5560
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\dllhost.exe
                                                                                                                                                                                                                                        dllhost.exe
                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                          PID:4628
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          cmd /c cmd < Col.aif
                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                            PID:5236
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              cmd
                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                PID:6916
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                  findstr /V /R "^UhYfGpTuZrzSdFeMeNaCLTnviEufMXMBGeXCcrpOPaOzqZuKoyxOwRoqPBiweDxedSkhHmsZEDNattvoncuHDYmPUWNUViMkYMeiOSrJOcpnrPVKtZDGvNnaaczLMvrvRBxaegxFabToO$" Conquista.aif
                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                    PID:7868
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Mie.exe.com
                                                                                                                                                                                                                                                    Mie.exe.com E
                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                      PID:2756
                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\i2rdaU591u9SDKjAF5VkAXCP.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\i2rdaU591u9SDKjAF5VkAXCP.exe"
                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                  PID:5568
                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\oNUVdpPkgX_AvQfJZtc_7uRh.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\oNUVdpPkgX_AvQfJZtc_7uRh.exe"
                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                    PID:5192
                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\bry5FIDmLUumSnlbDul4901t.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\bry5FIDmLUumSnlbDul4901t.exe"
                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                      PID:5296
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\1.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\1.exe"
                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                          PID:7708
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\2.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\2.exe"
                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                            PID:7896
                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0bljypb2.h2r\gcleaner.exe /mixfive & exit
                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                        PID:5636
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0bljypb2.h2r\gcleaner.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\0bljypb2.h2r\gcleaner.exe /mixfive
                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                            PID:5820
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 688
                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                              PID:196
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 640
                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                              PID:1916
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 684
                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                              PID:5144
                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sgyixf0c.n4s\autosubplayer.exe /S & exit
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                            PID:1232
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Fri22ab166dee75e0.exe
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                  PID:3296
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS872E65B4\Fri22ab166dee75e0.exe
                                                                                                                                                                                                                                                    Fri22ab166dee75e0.exe
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                    PID:2188
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Fri22e9866a3a24.exe
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                  PID:3668
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS872E65B4\Fri22e9866a3a24.exe
                                                                                                                                                                                                                                                    Fri22e9866a3a24.exe
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:3896
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 1416
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                      PID:4288
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c APPNAME7.exe
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:1820
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c Fri2204c8b2ca47c.exe
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                    PID:1156
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS872E65B4\Fri2204c8b2ca47c.exe
                                                                                                                                                                                                                                                      Fri2204c8b2ca47c.exe
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                      PID:2156
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                        PID:900
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:648
                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                              PID:5328
                                                                                                                                                                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                                                                PID:5500
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\services64.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\services64.exe"
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                PID:5776
                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                    PID:6584
                                                                                                                                                                                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                                      PID:5856
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                      PID:4372
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  PID:2044
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2.exe"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  PID:3884
                                                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 3884 -s 1528
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                    PID:4404
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:688
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 800
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                    PID:4136
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 844
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                    PID:4888
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 868
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                    PID:3860
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 1016
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                    PID:4128
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 1020
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                    PID:4116
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 956
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                    PID:4140
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Pubdate.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Pubdate.exe"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:3748
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:3152
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-9PR1E.tmp\setup_2.tmp
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-9PR1E.tmp\setup_2.tmp" /SL5="$501A6,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                    PID:1888
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:4560
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-P0BU4.tmp\setup_2.tmp
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-P0BU4.tmp\setup_2.tmp" /SL5="$301F4,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                        PID:4636
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:4068
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:4544
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:4196
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                    PID:4380
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c APPNAME6.exe
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:2124
                                                                                                                                                                                                                                                          • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                            PID:1184
                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                              PID:5000
                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                            PID:4852
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                              PID:4880
                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                            PID:5108
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:1816
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 640
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                  PID:5024
                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:5116
                                                                                                                                                                                                                                                              • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:5224
                                                                                                                                                                                                                                                                • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:5672
                                                                                                                                                                                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 5C6D6F5A3CB68A38EE9C2CE0C6A99B04 C
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:640

                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                          memory/64-300-0x0000027322C00000-0x0000027322C74000-memory.dmp

                                                                                                                                                                                                                                                                          memory/648-188-0x0000000000580000-0x0000000000581000-memory.dmp

                                                                                                                                                                                                                                                                          memory/648-615-0x000000001C950000-0x000000001C952000-memory.dmp

                                                                                                                                                                                                                                                                          memory/648-611-0x0000000000F20000-0x0000000000F21000-memory.dmp

                                                                                                                                                                                                                                                                          memory/648-610-0x0000000000EF0000-0x0000000000EFA000-memory.dmp

                                                                                                                                                                                                                                                                          memory/688-333-0x00000000001D0000-0x00000000001FF000-memory.dmp

                                                                                                                                                                                                                                                                          memory/688-354-0x0000000000400000-0x0000000002167000-memory.dmp

                                                                                                                                                                                                                                                                          memory/900-181-0x00000000009D0000-0x00000000009D1000-memory.dmp

                                                                                                                                                                                                                                                                          memory/1044-330-0x0000026E7ECB0000-0x0000026E7ED24000-memory.dmp

                                                                                                                                                                                                                                                                          memory/1096-305-0x0000025761D60000-0x0000025761DD4000-memory.dmp

                                                                                                                                                                                                                                                                          memory/1184-280-0x00000201956C0000-0x0000020195734000-memory.dmp

                                                                                                                                                                                                                                                                          memory/1184-290-0x00000201953E0000-0x000002019542D000-memory.dmp

                                                                                                                                                                                                                                                                          memory/1204-332-0x00000143C1F60000-0x00000143C1FD4000-memory.dmp

                                                                                                                                                                                                                                                                          memory/1248-341-0x00000167FB370000-0x00000167FB3E4000-memory.dmp

                                                                                                                                                                                                                                                                          memory/1404-336-0x000001930B880000-0x000001930B8F4000-memory.dmp

                                                                                                                                                                                                                                                                          memory/1816-408-0x0000000004950000-0x0000000004A51000-memory.dmp

                                                                                                                                                                                                                                                                          memory/1848-343-0x000001F5312D0000-0x000001F531344000-memory.dmp

                                                                                                                                                                                                                                                                          memory/1888-235-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                          memory/2044-205-0x00000000029A0000-0x00000000029B7000-memory.dmp

                                                                                                                                                                                                                                                                          memory/2044-220-0x000000001B740000-0x000000001B742000-memory.dmp

                                                                                                                                                                                                                                                                          memory/2044-193-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                                                                                                                                                                                                                                                                          memory/2156-160-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

                                                                                                                                                                                                                                                                          memory/2156-169-0x000000001BA40000-0x000000001BA42000-memory.dmp

                                                                                                                                                                                                                                                                          memory/2188-177-0x000000001BB40000-0x000000001BB42000-memory.dmp

                                                                                                                                                                                                                                                                          memory/2188-166-0x0000000000F10000-0x0000000000F11000-memory.dmp

                                                                                                                                                                                                                                                                          memory/2188-174-0x0000000001360000-0x0000000001376000-memory.dmp

                                                                                                                                                                                                                                                                          memory/2324-309-0x000002E654120000-0x000002E654194000-memory.dmp

                                                                                                                                                                                                                                                                          memory/2364-307-0x000001FF17DB0000-0x000001FF17E24000-memory.dmp

                                                                                                                                                                                                                                                                          memory/2616-352-0x0000022B92270000-0x0000022B922E4000-memory.dmp

                                                                                                                                                                                                                                                                          memory/2624-382-0x0000025EC1740000-0x0000025EC17B4000-memory.dmp

                                                                                                                                                                                                                                                                          memory/2632-291-0x000002F435380000-0x000002F4353F4000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-241-0x0000000007EE0000-0x0000000007EE1000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-199-0x00000000076E0000-0x00000000076E1000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-277-0x000000007F5B0000-0x000000007F5B1000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-229-0x0000000006A20000-0x0000000006A21000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-572-0x00000000090B0000-0x00000000090B1000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-564-0x00000000090D0000-0x00000000090D1000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-273-0x0000000008C70000-0x0000000008C71000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-297-0x00000000091D0000-0x00000000091D1000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-303-0x0000000006763000-0x0000000006764000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-171-0x0000000006760000-0x0000000006761000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-225-0x0000000007750000-0x0000000007751000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-172-0x0000000006700000-0x0000000006701000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-288-0x0000000008E00000-0x0000000008E01000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-175-0x0000000006DA0000-0x0000000006DA1000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-176-0x0000000006762000-0x0000000006763000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-206-0x00000000077F0000-0x00000000077F1000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-184-0x0000000006D10000-0x0000000006D11000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-194-0x0000000007500000-0x0000000007501000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3136-263-0x0000000008CD0000-0x0000000008D03000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3152-223-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-579-0x0000000008F60000-0x0000000008F61000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-379-0x0000000006770000-0x0000000006771000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-550-0x00000000084C0000-0x00000000084C1000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-559-0x0000000008690000-0x0000000008691000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-575-0x0000000008D90000-0x0000000008D91000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-406-0x0000000006904000-0x0000000006906000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-390-0x0000000006880000-0x0000000006881000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-384-0x0000000006903000-0x0000000006904000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-350-0x0000000002280000-0x00000000023CA000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-381-0x0000000006902000-0x0000000006903000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-347-0x0000000006900000-0x0000000006901000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-375-0x0000000004400000-0x0000000004401000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-367-0x0000000006E10000-0x0000000006E11000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-344-0x0000000003E10000-0x0000000003E2D000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-364-0x0000000004260000-0x000000000427C000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-362-0x0000000006910000-0x0000000006911000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3748-339-0x0000000000400000-0x000000000216E000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3884-219-0x000000001AE90000-0x000000001AE92000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3884-202-0x0000000000230000-0x0000000000231000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3896-198-0x0000000004890000-0x0000000004963000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3896-203-0x0000000000400000-0x0000000002BB8000-memory.dmp

                                                                                                                                                                                                                                                                          memory/3972-195-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4068-609-0x0000000000400000-0x0000000002B67000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4068-608-0x0000000002B70000-0x0000000002CBA000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4084-173-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4088-167-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4088-164-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4088-159-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4088-132-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4088-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4088-158-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4088-131-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4136-425-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4244-424-0x0000000000400000-0x0000000000416000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4280-242-0x0000000002FA0000-0x0000000002FA2000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4380-239-0x0000000000400000-0x0000000000401000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4380-243-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4560-254-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4636-256-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4880-287-0x0000000003FA0000-0x0000000003FFF000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4880-283-0x00000000040B5000-0x00000000041B6000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4884-426-0x0000000002510000-0x0000000002512000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4936-429-0x0000000001680000-0x0000000001682000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4936-450-0x0000000001682000-0x0000000001684000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4936-566-0x0000000001685000-0x0000000001686000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4936-452-0x0000000001684000-0x0000000001685000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4972-432-0x00000000025E0000-0x00000000025E2000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4972-474-0x00000000025E4000-0x00000000025E5000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4972-476-0x00000000025E5000-0x00000000025E7000-memory.dmp

                                                                                                                                                                                                                                                                          memory/4972-472-0x00000000025E2000-0x00000000025E4000-memory.dmp

                                                                                                                                                                                                                                                                          memory/5000-292-0x000001F2AA470000-0x000001F2AA4E4000-memory.dmp

                                                                                                                                                                                                                                                                          memory/5000-513-0x000001F2ACB90000-0x000001F2ACC96000-memory.dmp

                                                                                                                                                                                                                                                                          memory/5000-512-0x000001F2ABCE0000-0x000001F2ABCFB000-memory.dmp

                                                                                                                                                                                                                                                                          memory/5116-612-0x000001A986220000-0x000001A986230000-memory.dmp