Overview

overview

10

Static

static

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows11_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

Resubmissions

23-09-2021 21:08

210923-zyzyaafbfr 10

22-09-2021 10:40

210922-mqyzssehck 10

22-09-2021 05:21

210922-f114ksecck 10

21-09-2021 05:29

210921-f6zspsgdg2 10

20-09-2021 21:51

210920-1qj3jafed9 10

20-09-2021 19:44

210920-yftswafca9 10

20-09-2021 08:28

210920-kczcasgahr 10

20-09-2021 04:42

210920-fb3acafedj 10

20-09-2021 04:42

210920-fb2zksfecr 10

Analysis

  • max time kernel
    1802s
  • max time network
    1806s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    20-09-2021 21:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_x86_x64_install.exe

  • Size

    4.0MB

  • MD5

    73491325fde5366b31c09da701d07dd6

  • SHA1

    a4e1ada57e590c2df30fc26fad5f3ca57ad922b1

  • SHA256

    56a461a6cc8ad9c10cdc1d19a12d5deceb9ebefb0c871a3fc2eb83c466947a11

  • SHA512

    28b5008c542e9c486529934f74774d6d2de4b98531483b24c3c7cf82bf2214b959a1feb0085014026dd278d2a18ac6ae8a0e5a7ebb36be28abf6dccbf2d38e88

Score
10/10
djvuredlinesmokeloadersocelarsvidar209qwe706janesamaspackv2backdoordiscoveryevasioninfostealerpersistenceransomwarespywarestealerthemidatrojan

Malware Config

Extracted

Path

C:\_readme.txt

Family

djvu

Ransom Note
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-vtoEIhR0SI Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0334gSd743d99p8vN1UYnRVfJrLk31VTLd69Ni5b0ex99QMQKt1
URLs

https://we.tl/t-vtoEIhR0SI

Extracted

Family

redline

Botnet

janesam

C2

65.108.20.195:6774

Extracted

Family

vidar

Version

40.7

Botnet

706

C2

https://petrenko96.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

209qwe

C2

185.215.113.104:18754

Signatures

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Vidar Stealer 2 IoCs
    stealer
  • ASPack v2.12-2.42 7 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Blocklisted process makes network request 49 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 44 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 12 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 15 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 12 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 45 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 19 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Kills process with taskkill 4 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 19 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:1004
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2572
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s BITS
        1⤵
        • Suspicious use of SetThreadContext
        PID:4628
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
          • Drops file in System32 directory
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          PID:5328
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
          PID:2704
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
          1⤵
            PID:2668
            • C:\Windows\system32\wbem\WMIADAP.EXE
              wmiadap.exe /F /T /R
              2⤵
                PID:6208
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
              1⤵
                PID:2412
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                1⤵
                  PID:2380
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                  1⤵
                    PID:1916
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s SENS
                    1⤵
                    • Modifies registry class
                    PID:1408
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                    1⤵
                      PID:1372
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Themes
                      1⤵
                        PID:1200
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                        1⤵
                          PID:1116
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                          1⤵
                          • Drops file in System32 directory
                          PID:1032
                          • C:\Users\Admin\AppData\Roaming\rgvsfuf
                            C:\Users\Admin\AppData\Roaming\rgvsfuf
                            2⤵
                            • Checks SCSI registry key(s)
                            • Suspicious behavior: MapViewOfSection
                            PID:6780
                          • C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95\A40D.exe
                            C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95\A40D.exe --Task
                            2⤵
                            • Suspicious use of SetThreadContext
                            PID:7656
                            • C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95\A40D.exe
                              C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95\A40D.exe --Task
                              3⤵
                                PID:7864
                            • C:\Users\Admin\AppData\Roaming\rgvsfuf
                              C:\Users\Admin\AppData\Roaming\rgvsfuf
                              2⤵
                              • Checks SCSI registry key(s)
                              • Suspicious behavior: MapViewOfSection
                              PID:6948
                            • C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95\A40D.exe
                              C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95\A40D.exe --Task
                              2⤵
                              • Suspicious use of SetThreadContext
                              PID:6432
                              • C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95\A40D.exe
                                C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95\A40D.exe --Task
                                3⤵
                                  PID:5224
                              • C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95\A40D.exe
                                C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95\A40D.exe --Task
                                2⤵
                                • Suspicious use of SetThreadContext
                                PID:5076
                                • C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95\A40D.exe
                                  C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95\A40D.exe --Task
                                  3⤵
                                    PID:3264
                                • C:\Users\Admin\AppData\Roaming\rgvsfuf
                                  C:\Users\Admin\AppData\Roaming\rgvsfuf
                                  2⤵
                                  • Checks SCSI registry key(s)
                                  • Suspicious behavior: MapViewOfSection
                                  PID:7456
                                • C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95\A40D.exe
                                  C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95\A40D.exe --Task
                                  2⤵
                                  • Suspicious use of SetThreadContext
                                  PID:2348
                                  • C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95\A40D.exe
                                    C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95\A40D.exe --Task
                                    3⤵
                                      PID:356
                                • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
                                  "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
                                  1⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3476
                                  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4160
                                    • C:\Users\Admin\AppData\Local\Temp\7zS040FC6E2\setup_install.exe
                                      "C:\Users\Admin\AppData\Local\Temp\7zS040FC6E2\setup_install.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of WriteProcessMemory
                                      PID:1424
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4280
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                          5⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:656
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Sun1917b8fb5f09db8.exe
                                        4⤵
                                          PID:4272
                                          • C:\Users\Admin\AppData\Local\Temp\7zS040FC6E2\Sun1917b8fb5f09db8.exe
                                            Sun1917b8fb5f09db8.exe
                                            5⤵
                                            • Executes dropped EXE
                                            • Checks computer location settings
                                            PID:2120
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c Sun19262b9e49ad.exe
                                          4⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4248
                                          • C:\Users\Admin\AppData\Local\Temp\7zS040FC6E2\Sun19262b9e49ad.exe
                                            Sun19262b9e49ad.exe
                                            5⤵
                                            • Executes dropped EXE
                                            • Modifies system certificate store
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3004
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd.exe /c taskkill /f /im chrome.exe
                                              6⤵
                                                PID:6296
                                                • C:\Windows\SysWOW64\taskkill.exe
                                                  taskkill /f /im chrome.exe
                                                  7⤵
                                                  • Kills process with taskkill
                                                  PID:6608
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Sun193fda712d9f1.exe
                                            4⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4256
                                            • C:\Users\Admin\AppData\Local\Temp\7zS040FC6E2\Sun193fda712d9f1.exe
                                              Sun193fda712d9f1.exe
                                              5⤵
                                              • Executes dropped EXE
                                              PID:420
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Sun1908b94df837b3158.exe
                                            4⤵
                                              PID:4428
                                              • C:\Users\Admin\AppData\Local\Temp\7zS040FC6E2\Sun1908b94df837b3158.exe
                                                Sun1908b94df837b3158.exe
                                                5⤵
                                                • Executes dropped EXE
                                                • Checks SCSI registry key(s)
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious behavior: MapViewOfSection
                                                PID:4564
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c Sun19de8ff4b6aefeb8.exe /mixone
                                              4⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4416
                                              • C:\Users\Admin\AppData\Local\Temp\7zS040FC6E2\Sun19de8ff4b6aefeb8.exe
                                                Sun19de8ff4b6aefeb8.exe /mixone
                                                5⤵
                                                • Executes dropped EXE
                                                PID:1420
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 656
                                                  6⤵
                                                  • Program crash
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3960
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 676
                                                  6⤵
                                                  • Program crash
                                                  PID:5264
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 712
                                                  6⤵
                                                  • Program crash
                                                  PID:5796
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 716
                                                  6⤵
                                                  • Program crash
                                                  PID:2220
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 880
                                                  6⤵
                                                  • Program crash
                                                  PID:6104
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 928
                                                  6⤵
                                                  • Program crash
                                                  PID:3340
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 1176
                                                  6⤵
                                                  • Program crash
                                                  PID:6172
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 1196
                                                  6⤵
                                                  • Program crash
                                                  PID:6344
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 1284
                                                  6⤵
                                                  • Program crash
                                                  PID:6512
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 1276
                                                  6⤵
                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                  • Program crash
                                                  PID:6616
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c Sun191101c1aaa.exe
                                              4⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4480
                                              • C:\Users\Admin\AppData\Local\Temp\7zS040FC6E2\Sun191101c1aaa.exe
                                                Sun191101c1aaa.exe
                                                5⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3996
                                                • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  PID:2912
                                                  • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                                                    7⤵
                                                    • Executes dropped EXE
                                                    PID:4332
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                                      8⤵
                                                        PID:4896
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                                          9⤵
                                                          • Creates scheduled task(s)
                                                          PID:2316
                                                      • C:\Users\Admin\AppData\Roaming\services64.exe
                                                        "C:\Users\Admin\AppData\Roaming\services64.exe"
                                                        8⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:5804
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                                          9⤵
                                                            PID:1136
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                                              10⤵
                                                              • Creates scheduled task(s)
                                                              PID:7432
                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                                            9⤵
                                                            • Executes dropped EXE
                                                            PID:7200
                                                          • C:\Windows\explorer.exe
                                                            C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                                                            9⤵
                                                              PID:5980
                                                        • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
                                                          7⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3488
                                                          • C:\ProgramData\2434586.exe
                                                            "C:\ProgramData\2434586.exe"
                                                            8⤵
                                                            • Executes dropped EXE
                                                            PID:4780
                                                          • C:\ProgramData\8899313.exe
                                                            "C:\ProgramData\8899313.exe"
                                                            8⤵
                                                            • Executes dropped EXE
                                                            • Checks BIOS information in registry
                                                            • Checks whether UAC is enabled
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            PID:5628
                                                          • C:\ProgramData\2018077.exe
                                                            "C:\ProgramData\2018077.exe"
                                                            8⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            PID:5768
                                                            • C:\ProgramData\2018077.exe
                                                              "C:\ProgramData\2018077.exe"
                                                              9⤵
                                                              • Executes dropped EXE
                                                              PID:5152
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5768 -s 892
                                                              9⤵
                                                              • Program crash
                                                              PID:5836
                                                          • C:\ProgramData\3610374.exe
                                                            "C:\ProgramData\3610374.exe"
                                                            8⤵
                                                            • Executes dropped EXE
                                                            • Checks BIOS information in registry
                                                            • Checks whether UAC is enabled
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            PID:3928
                                                          • C:\ProgramData\6153729.exe
                                                            "C:\ProgramData\6153729.exe"
                                                            8⤵
                                                            • Executes dropped EXE
                                                            PID:5480
                                                        • C:\Users\Admin\AppData\Local\Temp\2.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\2.exe"
                                                          7⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4164
                                                        • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                          7⤵
                                                          • Executes dropped EXE
                                                          PID:4068
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 812
                                                            8⤵
                                                            • Program crash
                                                            PID:5156
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 844
                                                            8⤵
                                                            • Program crash
                                                            PID:5848
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 888
                                                            8⤵
                                                            • Program crash
                                                            PID:5636
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 960
                                                            8⤵
                                                            • Program crash
                                                            PID:5148
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 928
                                                            8⤵
                                                            • Program crash
                                                            PID:3264
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 972
                                                            8⤵
                                                            • Executes dropped EXE
                                                            • Program crash
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:864
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 1048
                                                            8⤵
                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                            • Program crash
                                                            PID:3496
                                                        • C:\Users\Admin\AppData\Local\Temp\udptest.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\udptest.exe"
                                                          7⤵
                                                          • Executes dropped EXE
                                                          PID:4444
                                                        • C:\Users\Admin\AppData\Local\Temp\5.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\5.exe"
                                                          7⤵
                                                            PID:864
                                                            • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                              8⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              PID:5648
                                                              • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                9⤵
                                                                • Executes dropped EXE
                                                                PID:5932
                                                          • C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe"
                                                            7⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2148
                                                          • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                                                            7⤵
                                                            • Executes dropped EXE
                                                            PID:2420
                                                            • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
                                                              8⤵
                                                              • Executes dropped EXE
                                                              PID:5252
                                                          • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                                                            7⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:644
                                                          • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                                            7⤵
                                                            • Executes dropped EXE
                                                            PID:3844
                                                          • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                            7⤵
                                                              PID:4800
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c Sun19eb40faaaa9.exe
                                                        4⤵
                                                          PID:4412
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS040FC6E2\Sun19eb40faaaa9.exe
                                                            Sun19eb40faaaa9.exe
                                                            5⤵
                                                            • Executes dropped EXE
                                                            PID:4304
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c Sun198361825f4.exe
                                                          4⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4388
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS040FC6E2\Sun198361825f4.exe
                                                            Sun198361825f4.exe
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:516
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c Sun1905815e51282417.exe
                                                          4⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2172
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS040FC6E2\Sun1905815e51282417.exe
                                                            Sun1905815e51282417.exe
                                                            5⤵
                                                            • Executes dropped EXE
                                                            PID:3236
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c Sun195a1614ec24e6a.exe
                                                          4⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3148
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS040FC6E2\Sun195a1614ec24e6a.exe
                                                            Sun195a1614ec24e6a.exe
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4456
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c Sun1966fb31dd5a07.exe
                                                          4⤵
                                                            PID:3204
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS040FC6E2\Sun1966fb31dd5a07.exe
                                                              Sun1966fb31dd5a07.exe
                                                              5⤵
                                                              • Executes dropped EXE
                                                              PID:3616
                                                              • C:\Users\Admin\AppData\Local\Temp\is-PCD9T.tmp\Sun1966fb31dd5a07.tmp
                                                                "C:\Users\Admin\AppData\Local\Temp\is-PCD9T.tmp\Sun1966fb31dd5a07.tmp" /SL5="$A01DC,247014,163328,C:\Users\Admin\AppData\Local\Temp\7zS040FC6E2\Sun1966fb31dd5a07.exe"
                                                                6⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                PID:2440
                                                                • C:\Users\Admin\AppData\Local\Temp\is-V513N.tmp\Ze2ro.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-V513N.tmp\Ze2ro.exe" /S /UID=burnerch2
                                                                  7⤵
                                                                  • Drops file in Drivers directory
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  • Drops file in Program Files directory
                                                                  PID:3460
                                                                  • C:\Program Files\Reference Assemblies\FSJYUWCQEK\ultramediaburner.exe
                                                                    "C:\Program Files\Reference Assemblies\FSJYUWCQEK\ultramediaburner.exe" /VERYSILENT
                                                                    8⤵
                                                                    • Executes dropped EXE
                                                                    PID:4800
                                                                    • C:\Users\Admin\AppData\Local\Temp\is-DC0VF.tmp\ultramediaburner.tmp
                                                                      "C:\Users\Admin\AppData\Local\Temp\is-DC0VF.tmp\ultramediaburner.tmp" /SL5="$30350,281924,62464,C:\Program Files\Reference Assemblies\FSJYUWCQEK\ultramediaburner.exe" /VERYSILENT
                                                                      9⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Program Files directory
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      PID:6048
                                                                      • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                        10⤵
                                                                        • Executes dropped EXE
                                                                        PID:5176
                                                                  • C:\Users\Admin\AppData\Local\Temp\7b-71301-455-838a9-a50deec93fa86\Lytaeshesovo.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\7b-71301-455-838a9-a50deec93fa86\Lytaeshesovo.exe"
                                                                    8⤵
                                                                    • Executes dropped EXE
                                                                    • Checks computer location settings
                                                                    PID:4336
                                                                  • C:\Users\Admin\AppData\Local\Temp\0e-f51ec-93b-39aaf-ff5ae88af92db\Wyqoqaerykae.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\0e-f51ec-93b-39aaf-ff5ae88af92db\Wyqoqaerykae.exe"
                                                                    8⤵
                                                                    • Executes dropped EXE
                                                                    PID:5788
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\21w3izht.4mv\GcleanerEU.exe /eufive & exit
                                                                      9⤵
                                                                        PID:6920
                                                                        • C:\Users\Admin\AppData\Local\Temp\21w3izht.4mv\GcleanerEU.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\21w3izht.4mv\GcleanerEU.exe /eufive
                                                                          10⤵
                                                                          • Executes dropped EXE
                                                                          PID:584
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\50irtghf.yxz\installer.exe /qn CAMPAIGN="654" & exit
                                                                        9⤵
                                                                          PID:7020
                                                                          • C:\Users\Admin\AppData\Local\Temp\50irtghf.yxz\installer.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\50irtghf.yxz\installer.exe /qn CAMPAIGN="654"
                                                                            10⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Enumerates connected drives
                                                                            • Modifies system certificate store
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            PID:6956
                                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                                              "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\50irtghf.yxz\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\50irtghf.yxz\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632174519 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                              11⤵
                                                                                PID:7520
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jjyclltl.vv0\anyname.exe & exit
                                                                            9⤵
                                                                              PID:5924
                                                                              • C:\Users\Admin\AppData\Local\Temp\jjyclltl.vv0\anyname.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\jjyclltl.vv0\anyname.exe
                                                                                10⤵
                                                                                • Executes dropped EXE
                                                                                PID:5528
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wgiwok4j.e3j\gcleaner.exe /mixfive & exit
                                                                              9⤵
                                                                                PID:6784
                                                                                • C:\Users\Admin\AppData\Local\Temp\wgiwok4j.e3j\gcleaner.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\wgiwok4j.e3j\gcleaner.exe /mixfive
                                                                                  10⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:4636
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c Sun19e4ade31b2a.exe
                                                                      4⤵
                                                                        PID:1716
                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS040FC6E2\Sun19e4ade31b2a.exe
                                                                          Sun19e4ade31b2a.exe
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2492
                                                                          • C:\Users\Admin\AppData\Roaming\1936579.scr
                                                                            "C:\Users\Admin\AppData\Roaming\1936579.scr" /S
                                                                            6⤵
                                                                              PID:2636
                                                                            • C:\Users\Admin\AppData\Roaming\7154338.scr
                                                                              "C:\Users\Admin\AppData\Roaming\7154338.scr" /S
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetThreadContext
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2644
                                                                              • C:\Users\Admin\AppData\Roaming\7154338.scr
                                                                                "C:\Users\Admin\AppData\Roaming\7154338.scr"
                                                                                7⤵
                                                                                • Executes dropped EXE
                                                                                PID:4276
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 840
                                                                                7⤵
                                                                                • Program crash
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:4904
                                                                            • C:\Users\Admin\AppData\Roaming\8611406.scr
                                                                              "C:\Users\Admin\AppData\Roaming\8611406.scr" /S
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              PID:4188
                                                                            • C:\Users\Admin\AppData\Roaming\2923357.scr
                                                                              "C:\Users\Admin\AppData\Roaming\2923357.scr" /S
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              • Checks BIOS information in registry
                                                                              • Checks whether UAC is enabled
                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                              PID:4008
                                                                            • C:\Users\Admin\AppData\Roaming\5453081.scr
                                                                              "C:\Users\Admin\AppData\Roaming\5453081.scr" /S
                                                                              6⤵
                                                                              • Executes dropped EXE
                                                                              • Checks BIOS information in registry
                                                                              • Checks whether UAC is enabled
                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:1044
                                                                  • C:\Users\Admin\AppData\Local\Temp\is-UVPD9.tmp\setup_2.tmp
                                                                    "C:\Users\Admin\AppData\Local\Temp\is-UVPD9.tmp\setup_2.tmp" /SL5="$10260,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    PID:4180
                                                                    • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:4972
                                                                      • C:\Users\Admin\AppData\Local\Temp\is-INFJ7.tmp\setup_2.tmp
                                                                        "C:\Users\Admin\AppData\Local\Temp\is-INFJ7.tmp\setup_2.tmp" /SL5="$4026A,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        PID:4328
                                                                  • C:\Windows\system32\rundll32.exe
                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    PID:3400
                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                      2⤵
                                                                      • Loads dropped DLL
                                                                      PID:5116
                                                                  • C:\Windows\system32\rundll32.exe
                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                    1⤵
                                                                    • Process spawned unexpected child process
                                                                    PID:6848
                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                      2⤵
                                                                      • Loads dropped DLL
                                                                      PID:6868
                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                    1⤵
                                                                    • Drops file in Windows directory
                                                                    • Modifies Internet Explorer settings
                                                                    • Modifies registry class
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:7060
                                                                  • C:\Windows\system32\browser_broker.exe
                                                                    C:\Windows\system32\browser_broker.exe -Embedding
                                                                    1⤵
                                                                    • Modifies Internet Explorer settings
                                                                    PID:640
                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                    1⤵
                                                                    • Suspicious behavior: MapViewOfSection
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:8
                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                    1⤵
                                                                    • Drops file in Windows directory
                                                                    • Modifies Internet Explorer settings
                                                                    • Modifies registry class
                                                                    PID:6504
                                                                  • C:\Windows\system32\msiexec.exe
                                                                    C:\Windows\system32\msiexec.exe /V
                                                                    1⤵
                                                                    • Enumerates connected drives
                                                                    • Drops file in Program Files directory
                                                                    • Drops file in Windows directory
                                                                    • Modifies data under HKEY_USERS
                                                                    • Modifies registry class
                                                                    PID:7284
                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 0C0A37B44004AFB859F54DC9F56C59C2 C
                                                                      2⤵
                                                                      • Loads dropped DLL
                                                                      PID:7504
                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 575FFDE669B7B0B009EE4ADA93670349
                                                                      2⤵
                                                                      • Blocklisted process makes network request
                                                                      • Loads dropped DLL
                                                                      PID:8180
                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                        "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                        3⤵
                                                                        • Kills process with taskkill
                                                                        PID:7960
                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding DB0C59FA15CBE95A99D965D9D04A538C E Global\MSI0000
                                                                      2⤵
                                                                      • Loads dropped DLL
                                                                      PID:1136
                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                    1⤵
                                                                      PID:7924
                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                      1⤵
                                                                      • Drops file in Windows directory
                                                                      PID:8100
                                                                    • C:\Windows\system32\rundll32.exe
                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                      1⤵
                                                                      • Process spawned unexpected child process
                                                                      • Blocklisted process makes network request
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2636
                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                        2⤵
                                                                        • Loads dropped DLL
                                                                        PID:2592
                                                                    • C:\Users\Admin\AppData\Local\Temp\7F1F.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\7F1F.exe
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      PID:7328
                                                                    • C:\Users\Admin\AppData\Local\Temp\A40D.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\A40D.exe
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      PID:6152
                                                                      • C:\Users\Admin\AppData\Local\Temp\A40D.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\A40D.exe
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Adds Run key to start application
                                                                        PID:6468
                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                          icacls "C:\Users\Admin\AppData\Local\20d92476-73e8-40c3-a6f5-9db843294a95" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                          3⤵
                                                                          • Modifies file permissions
                                                                          PID:5580
                                                                        • C:\Users\Admin\AppData\Local\Temp\A40D.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\A40D.exe" --Admin IsNotAutoStart IsNotTask
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetThreadContext
                                                                          PID:7432
                                                                          • C:\Users\Admin\AppData\Local\Temp\A40D.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\A40D.exe" --Admin IsNotAutoStart IsNotTask
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            • Modifies extensions of user files
                                                                            PID:7604
                                                                            • C:\Users\Admin\AppData\Local\b3adaf5c-1947-4996-93b8-baffabc00d6d\build2.exe
                                                                              "C:\Users\Admin\AppData\Local\b3adaf5c-1947-4996-93b8-baffabc00d6d\build2.exe"
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetThreadContext
                                                                              PID:3724
                                                                              • C:\Users\Admin\AppData\Local\b3adaf5c-1947-4996-93b8-baffabc00d6d\build2.exe
                                                                                "C:\Users\Admin\AppData\Local\b3adaf5c-1947-4996-93b8-baffabc00d6d\build2.exe"
                                                                                6⤵
                                                                                • Loads dropped DLL
                                                                                • Checks processor information in registry
                                                                                PID:6784
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\b3adaf5c-1947-4996-93b8-baffabc00d6d\build2.exe" & del C:\ProgramData\*.dll & exit
                                                                                  7⤵
                                                                                    PID:7584
                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                      taskkill /im build2.exe /f
                                                                                      8⤵
                                                                                      • Kills process with taskkill
                                                                                      PID:2068
                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                      timeout /t 6
                                                                                      8⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:7872
                                                                      • C:\Users\Admin\AppData\Local\Temp\BB40.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\BB40.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:4056
                                                                      • C:\Users\Admin\AppData\Local\Temp\8056.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\8056.exe
                                                                        1⤵
                                                                        • Checks BIOS information in registry
                                                                        • Checks whether UAC is enabled
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        PID:6080
                                                                      • C:\Users\Admin\AppData\Local\Temp\1BC.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\1BC.exe
                                                                        1⤵
                                                                          PID:4420
                                                                        • C:\Users\Admin\AppData\Local\Temp\B6E4.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\B6E4.exe
                                                                          1⤵
                                                                            PID:7228
                                                                          • C:\Users\Admin\AppData\Local\Temp\EE.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\EE.exe
                                                                            1⤵
                                                                            • Loads dropped DLL
                                                                            • Checks processor information in registry
                                                                            PID:6932
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /c taskkill /im EE.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\EE.exe" & del C:\ProgramData\*.dll & exit
                                                                              2⤵
                                                                                PID:5076
                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                  taskkill /im EE.exe /f
                                                                                  3⤵
                                                                                  • Kills process with taskkill
                                                                                  PID:6176
                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                  timeout /t 6
                                                                                  3⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:7060
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                              1⤵
                                                                              • Drops file in Windows directory
                                                                              • Modifies registry class
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:6980
                                                                            • C:\Windows\system32\browser_broker.exe
                                                                              C:\Windows\system32\browser_broker.exe -Embedding
                                                                              1⤵
                                                                              • Modifies Internet Explorer settings
                                                                              PID:7404
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Suspicious behavior: MapViewOfSection
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1192
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Drops file in Windows directory
                                                                              • Modifies registry class
                                                                              PID:6228
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              PID:4396
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Drops file in Windows directory
                                                                              • Modifies registry class
                                                                              PID:6320
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                                PID:6084
                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                1⤵
                                                                                • Drops file in Windows directory
                                                                                • Modifies registry class
                                                                                PID:2804
                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                PID:7072
                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                1⤵
                                                                                • Drops file in Windows directory
                                                                                • Modifies registry class
                                                                                PID:8184
                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                1⤵
                                                                                • Drops file in Windows directory
                                                                                • Modifies registry class
                                                                                PID:5572
                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                1⤵
                                                                                • Drops file in Windows directory
                                                                                • Modifies registry class
                                                                                PID:7896
                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                1⤵
                                                                                  PID:4444
                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                  1⤵
                                                                                  • Drops file in Windows directory
                                                                                  • Modifies registry class
                                                                                  PID:5320
                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                  1⤵
                                                                                  • Modifies registry class
                                                                                  PID:5180

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v6

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • memory/516-220-0x00000162E3CF5000-0x00000162E3CF7000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/516-213-0x00000162E3CF0000-0x00000162E3CF2000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/516-221-0x00000162E3CF4000-0x00000162E3CF5000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/516-215-0x00000162E3E00000-0x00000162E3E7E000-memory.dmp

                                                                                  Filesize

                                                                                  504KB

                                                                                  Download

                                                                                • memory/516-219-0x00000162E3CF2000-0x00000162E3CF4000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/516-190-0x00000162C9530000-0x00000162C9531000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/516-199-0x00000162C99B0000-0x00000162C99BB000-memory.dmp

                                                                                  Filesize

                                                                                  44KB

                                                                                  Download

                                                                                • memory/644-318-0x0000000000680000-0x0000000000681000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/644-329-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/656-224-0x0000000007410000-0x0000000007411000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/656-211-0x0000000006CE0000-0x0000000006CE1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/656-281-0x0000000006BE0000-0x0000000006BE1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/656-206-0x0000000004430000-0x0000000004431000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/656-228-0x0000000007480000-0x0000000007481000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/656-222-0x0000000006C20000-0x0000000006C21000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/656-212-0x00000000066A2000-0x00000000066A3000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/656-208-0x00000000066A0000-0x00000000066A1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/656-225-0x0000000006C50000-0x0000000006C51000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/656-313-0x0000000007C50000-0x0000000007C51000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/864-279-0x0000000000300000-0x0000000000301000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/864-292-0x0000000000A70000-0x0000000000A72000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/1004-376-0x0000019549A90000-0x0000019549B04000-memory.dmp

                                                                                  Filesize

                                                                                  464KB

                                                                                  Download

                                                                                • memory/1032-446-0x000001BC2C170000-0x000001BC2C1E4000-memory.dmp

                                                                                  Filesize

                                                                                  464KB

                                                                                  Download

                                                                                • memory/1044-416-0x0000000005400000-0x0000000005401000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/1044-328-0x0000000077170000-0x00000000772FE000-memory.dmp

                                                                                  Filesize

                                                                                  1.6MB

                                                                                  Download

                                                                                • memory/1116-419-0x000001EFC9640000-0x000001EFC96B4000-memory.dmp

                                                                                  Filesize

                                                                                  464KB

                                                                                  Download

                                                                                • memory/1420-240-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                  Filesize

                                                                                  408KB

                                                                                  Download

                                                                                • memory/1420-238-0x00000000006F0000-0x0000000000738000-memory.dmp

                                                                                  Filesize

                                                                                  288KB

                                                                                  Download

                                                                                • memory/1424-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                  Filesize

                                                                                  100KB

                                                                                  Download

                                                                                • memory/1424-139-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                  Filesize

                                                                                  100KB

                                                                                  Download

                                                                                • memory/1424-134-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                  Filesize

                                                                                  572KB

                                                                                  Download

                                                                                • memory/1424-135-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                  Filesize

                                                                                  1.5MB

                                                                                  Download

                                                                                • memory/1424-140-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                  Filesize

                                                                                  100KB

                                                                                  Download

                                                                                • memory/1424-138-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                  Filesize

                                                                                  100KB

                                                                                  Download

                                                                                • memory/1424-136-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                  Filesize

                                                                                  152KB

                                                                                  Download

                                                                                • memory/2148-325-0x000001AE331D5000-0x000001AE331D7000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/2148-303-0x000001AE331D0000-0x000001AE331D2000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/2148-326-0x000001AE331D2000-0x000001AE331D4000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/2148-294-0x000001AE18B60000-0x000001AE18B61000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2148-327-0x000001AE331D4000-0x000001AE331D5000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2380-403-0x0000019F61C70000-0x0000019F61CE4000-memory.dmp

                                                                                  Filesize

                                                                                  464KB

                                                                                  Download

                                                                                • memory/2412-389-0x000001EB505C0000-0x000001EB50634000-memory.dmp

                                                                                  Filesize

                                                                                  464KB

                                                                                  Download

                                                                                • memory/2440-217-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2492-196-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2492-205-0x000000001B980000-0x000000001B982000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/2492-201-0x0000000001110000-0x0000000001111000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2572-399-0x0000020862140000-0x00000208621B4000-memory.dmp

                                                                                  Filesize

                                                                                  464KB

                                                                                  Download

                                                                                • memory/2636-295-0x00000000054C0000-0x00000000054C1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2636-282-0x00000000013D0000-0x00000000013D1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2636-296-0x0000000008270000-0x0000000008271000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2636-293-0x0000000007B70000-0x0000000007B71000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2636-272-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2644-315-0x0000000005220000-0x0000000005238000-memory.dmp

                                                                                  Filesize

                                                                                  96KB

                                                                                  Download

                                                                                • memory/2644-320-0x00000000051E0000-0x0000000005272000-memory.dmp

                                                                                  Filesize

                                                                                  584KB

                                                                                  Download

                                                                                • memory/2644-306-0x0000000005280000-0x0000000005281000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2644-302-0x0000000000A30000-0x0000000000A31000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2644-324-0x0000000005270000-0x0000000005273000-memory.dmp

                                                                                  Filesize

                                                                                  12KB

                                                                                  Download

                                                                                • memory/2644-304-0x0000000005880000-0x0000000005881000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2912-229-0x0000000000910000-0x0000000000911000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/3060-305-0x00000000008F0000-0x0000000000905000-memory.dmp

                                                                                  Filesize

                                                                                  84KB

                                                                                  Download

                                                                                • memory/3460-258-0x00000000023E0000-0x00000000023E2000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/3488-254-0x0000000000260000-0x0000000000261000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/3488-266-0x0000000000B10000-0x0000000000B11000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/3488-275-0x000000001ADA0000-0x000000001ADA2000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/3616-209-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                                  Filesize

                                                                                  184KB

                                                                                  Download

                                                                                • memory/3996-181-0x0000000000920000-0x0000000000921000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/3996-204-0x000000001B590000-0x000000001B592000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/4008-448-0x0000000005130000-0x0000000005131000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4008-407-0x0000000077170000-0x00000000772FE000-memory.dmp

                                                                                  Filesize

                                                                                  1.6MB

                                                                                  Download

                                                                                • memory/4068-343-0x00000000001D0000-0x00000000001FF000-memory.dmp

                                                                                  Filesize

                                                                                  188KB

                                                                                  Download

                                                                                • memory/4068-345-0x0000000000400000-0x0000000000458000-memory.dmp

                                                                                  Filesize

                                                                                  352KB

                                                                                  Download

                                                                                • memory/4164-262-0x0000000000480000-0x0000000000481000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4164-273-0x000000001AF50000-0x000000001AF52000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/4180-323-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4188-361-0x0000000005200000-0x0000000005201000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4276-319-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                  Filesize

                                                                                  136KB

                                                                                  Download

                                                                                • memory/4276-357-0x00000000055B0000-0x0000000005BB6000-memory.dmp

                                                                                  Filesize

                                                                                  6.0MB

                                                                                  Download

                                                                                • memory/4304-259-0x0000000000400000-0x00000000004D7000-memory.dmp

                                                                                  Filesize

                                                                                  860KB

                                                                                  Download

                                                                                • memory/4304-253-0x0000000000A00000-0x0000000000AD4000-memory.dmp

                                                                                  Filesize

                                                                                  848KB

                                                                                  Download

                                                                                • memory/4328-393-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4332-236-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4444-370-0x00000000026E0000-0x00000000026E1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4444-390-0x00000000026E3000-0x00000000026E4000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4444-411-0x00000000026E4000-0x00000000026E6000-memory.dmp

                                                                                  Filesize

                                                                                  8KB

                                                                                  Download

                                                                                • memory/4444-367-0x0000000000590000-0x00000000006DA000-memory.dmp

                                                                                  Filesize

                                                                                  1.3MB

                                                                                  Download

                                                                                • memory/4444-387-0x00000000026E2000-0x00000000026E3000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4444-373-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                  Filesize

                                                                                  384KB

                                                                                  Download

                                                                                • memory/4456-231-0x0000000005A20000-0x0000000005A43000-memory.dmp

                                                                                  Filesize

                                                                                  140KB

                                                                                  Download

                                                                                • memory/4456-255-0x0000000005C30000-0x0000000005C31000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4456-214-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4456-265-0x0000000005B60000-0x0000000005B61000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4456-283-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4456-232-0x0000000004B10000-0x0000000004B2D000-memory.dmp

                                                                                  Filesize

                                                                                  116KB

                                                                                  Download

                                                                                • memory/4456-243-0x0000000006080000-0x0000000006081000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4456-207-0x0000000000300000-0x0000000000301000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4456-218-0x00000000051D0000-0x00000000051D1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4456-250-0x0000000005B00000-0x0000000005B01000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4564-244-0x0000000000030000-0x0000000000039000-memory.dmp

                                                                                  Filesize

                                                                                  36KB

                                                                                  Download

                                                                                • memory/4564-248-0x0000000000400000-0x000000000044D000-memory.dmp

                                                                                  Filesize

                                                                                  308KB

                                                                                  Download

                                                                                • memory/4628-381-0x0000024544A70000-0x0000024544AE4000-memory.dmp

                                                                                  Filesize

                                                                                  464KB

                                                                                  Download

                                                                                • memory/4628-351-0x00000245448B0000-0x00000245448FD000-memory.dmp

                                                                                  Filesize

                                                                                  308KB

                                                                                  Download

                                                                                • memory/4780-422-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4800-307-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                  Filesize

                                                                                  80KB

                                                                                  Download

                                                                                • memory/4972-335-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                  Filesize

                                                                                  80KB

                                                                                  Download

                                                                                • memory/5116-347-0x00000000046F6000-0x00000000047F7000-memory.dmp

                                                                                  Filesize

                                                                                  1.0MB

                                                                                  Download

                                                                                • memory/5116-350-0x0000000004640000-0x000000000469F000-memory.dmp

                                                                                  Filesize

                                                                                  380KB

                                                                                  Download

                                                                                • memory/5328-427-0x00000249F5650000-0x00000249F56C4000-memory.dmp

                                                                                  Filesize

                                                                                  464KB

                                                                                  Download

                                                                                • memory/5768-432-0x00000000055F0000-0x00000000055F1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download