Analysis

  • max time kernel
    8s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    27/12/2021, 00:11

General

  • Target

    a485cb752e66e54c92ef00a9ae8f2eba.exe

  • Size

    6.4MB

  • MD5

    a485cb752e66e54c92ef00a9ae8f2eba

  • SHA1

    c267fb5e1d5bd1abd6b3d4d4faea91587b600586

  • SHA256

    1d7c3a08d1e69e704039850f64a88363fc6c9f3721907aa3c0d8165ae20de3a1

  • SHA512

    c8b4a0c892f00a395ad01edcc2798f1ba51c1efe94b7579c5f857277658f6ce18e6da46dfde3969fd1dfc45083de68552b86a8d16658816f2c91c8eec2b278b1

Malware Config

Extracted

Family

socelars

C2

http://www.chosenncrowned.com/

Extracted

Family

redline

Botnet

userv1

C2

159.69.246.184:13127

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 5 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 16 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Loads dropped DLL 6 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 11 IoCs
  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a485cb752e66e54c92ef00a9ae8f2eba.exe
    "C:\Users\Admin\AppData\Local\Temp\a485cb752e66e54c92ef00a9ae8f2eba.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3816
      • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1792
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4308
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
            5⤵
              PID:508
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4368
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              5⤵
                PID:900
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Fri05e80376d7965136.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4360
              • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri05e80376d7965136.exe
                Fri05e80376d7965136.exe
                5⤵
                • Executes dropped EXE
                PID:3096
                • C:\Users\Admin\AppData\Local\Temp\is-BUQME.tmp\Fri05e80376d7965136.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-BUQME.tmp\Fri05e80376d7965136.tmp" /SL5="$8005E,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri05e80376d7965136.exe"
                  6⤵
                    PID:1984
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Fri0573cd0e4548.exe
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4416
                • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri0573cd0e4548.exe
                  Fri0573cd0e4548.exe
                  5⤵
                  • Executes dropped EXE
                  PID:3192
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c taskkill /im Fri0573cd0e4548.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri0573cd0e4548.exe" & del C:\ProgramData\*.dll & exit
                    6⤵
                      PID:3588
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /im Fri0573cd0e4548.exe /f
                        7⤵
                        • Kills process with taskkill
                        PID:5468
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Fri053a5ee7e3db.exe
                  4⤵
                    PID:4408
                    • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri053a5ee7e3db.exe
                      Fri053a5ee7e3db.exe
                      5⤵
                      • Executes dropped EXE
                      PID:412
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Fri055ab567d9ab89d73.exe
                    4⤵
                      PID:4320
                      • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri055ab567d9ab89d73.exe
                        Fri055ab567d9ab89d73.exe
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1120
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Fri05d87299ab2865e.exe
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4312
                      • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri05d87299ab2865e.exe
                        Fri05d87299ab2865e.exe
                        5⤵
                        • Executes dropped EXE
                        PID:500
                        • C:\Windows\SysWOW64\control.exe
                          "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\KGG6K.cpL",
                          6⤵
                            PID:4340
                            • C:\Windows\SysWOW64\rundll32.exe
                              "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\KGG6K.cpL",
                              7⤵
                                PID:3564
                                • C:\Windows\system32\RunDll32.exe
                                  C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\KGG6K.cpL",
                                  8⤵
                                    PID:1508
                                    • C:\Windows\SysWOW64\rundll32.exe
                                      "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\KGG6K.cpL",
                                      9⤵
                                        PID:5216
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Fri05f64325d01.exe
                              4⤵
                                PID:4448
                                • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri05f64325d01.exe
                                  Fri05f64325d01.exe
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1272
                                  • C:\Users\Admin\AppData\Local\7f7b0dd0-4fdf-452d-aead-f1f911216baa.exe
                                    "C:\Users\Admin\AppData\Local\7f7b0dd0-4fdf-452d-aead-f1f911216baa.exe"
                                    6⤵
                                      PID:4256
                                      • C:\Users\Admin\AppData\Roaming\40883256\500220240882664.exe
                                        "C:\Users\Admin\AppData\Roaming\40883256\500220240882664.exe"
                                        7⤵
                                          PID:5028
                                      • C:\Users\Admin\AppData\Local\2a6edbc5-64c5-4134-9351-b555741cc9bb.exe
                                        "C:\Users\Admin\AppData\Local\2a6edbc5-64c5-4134-9351-b555741cc9bb.exe"
                                        6⤵
                                          PID:3280
                                        • C:\Users\Admin\AppData\Local\f15438d6-566f-4f96-b904-fa72c0c9a3d3.exe
                                          "C:\Users\Admin\AppData\Local\f15438d6-566f-4f96-b904-fa72c0c9a3d3.exe"
                                          6⤵
                                            PID:1908
                                            • C:\Users\Admin\AppData\Roaming\8313719.exe
                                              "C:\Users\Admin\AppData\Roaming\8313719.exe"
                                              7⤵
                                                PID:4324
                                                • C:\Windows\SysWOW64\control.exe
                                                  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\EdRGQQA5.cPl",
                                                  8⤵
                                                    PID:4448
                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\EdRGQQA5.cPl",
                                                      9⤵
                                                        PID:2008
                                                        • C:\Windows\system32\RunDll32.exe
                                                          C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\EdRGQQA5.cPl",
                                                          10⤵
                                                            PID:4976
                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                              "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\EdRGQQA5.cPl",
                                                              11⤵
                                                                PID:5764
                                                    • C:\Users\Admin\AppData\Local\c43aa6d5-ac06-450b-b812-a2538602be01.exe
                                                      "C:\Users\Admin\AppData\Local\c43aa6d5-ac06-450b-b812-a2538602be01.exe"
                                                      6⤵
                                                        PID:4116
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c Fri0510f5b933f.exe /mixtwo
                                                    4⤵
                                                      PID:3880
                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri0510f5b933f.exe
                                                        Fri0510f5b933f.exe /mixtwo
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:1444
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c Fri0573351d0136.exe
                                                      4⤵
                                                        PID:640
                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri0573351d0136.exe
                                                          Fri0573351d0136.exe
                                                          5⤵
                                                            PID:4884
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c Fri0506cb2ead94f.exe
                                                          4⤵
                                                            PID:1004
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri0506cb2ead94f.exe
                                                              Fri0506cb2ead94f.exe
                                                              5⤵
                                                                PID:3932
                                                                • C:\Users\Admin\Pictures\Adobe Films\1_zCZOVXPqmK6ZhxCsSdirPQ.exe
                                                                  "C:\Users\Admin\Pictures\Adobe Films\1_zCZOVXPqmK6ZhxCsSdirPQ.exe"
                                                                  6⤵
                                                                    PID:5032
                                                                  • C:\Users\Admin\Pictures\Adobe Films\w3vgGIsJDXWLbrdEtxwdxAD5.exe
                                                                    "C:\Users\Admin\Pictures\Adobe Films\w3vgGIsJDXWLbrdEtxwdxAD5.exe"
                                                                    6⤵
                                                                      PID:4352
                                                                    • C:\Users\Admin\Pictures\Adobe Films\pizGiuqVn7zFmjN5fpg2oAto.exe
                                                                      "C:\Users\Admin\Pictures\Adobe Films\pizGiuqVn7zFmjN5fpg2oAto.exe"
                                                                      6⤵
                                                                        PID:2968
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im pizGiuqVn7zFmjN5fpg2oAto.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\pizGiuqVn7zFmjN5fpg2oAto.exe" & del C:\ProgramData\*.dll & exit
                                                                          7⤵
                                                                            PID:3940
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              taskkill /im pizGiuqVn7zFmjN5fpg2oAto.exe /f
                                                                              8⤵
                                                                              • Kills process with taskkill
                                                                              PID:2564
                                                                        • C:\Users\Admin\Pictures\Adobe Films\T26AeTZg9ROMlIRlpgNdpF85.exe
                                                                          "C:\Users\Admin\Pictures\Adobe Films\T26AeTZg9ROMlIRlpgNdpF85.exe"
                                                                          6⤵
                                                                            PID:3120
                                                                            • C:\Users\Admin\Documents\Z7x18hhbn299M11pHMjJKC6t.exe
                                                                              "C:\Users\Admin\Documents\Z7x18hhbn299M11pHMjJKC6t.exe"
                                                                              7⤵
                                                                                PID:2024
                                                                                • C:\Users\Admin\Pictures\Adobe Films\rDDBBbWvH5Ax97KNy0JvEMYl.exe
                                                                                  "C:\Users\Admin\Pictures\Adobe Films\rDDBBbWvH5Ax97KNy0JvEMYl.exe"
                                                                                  8⤵
                                                                                    PID:6052
                                                                                  • C:\Users\Admin\Pictures\Adobe Films\tDTIQ3G6R3WOK_z_Rm7_FBZe.exe
                                                                                    "C:\Users\Admin\Pictures\Adobe Films\tDTIQ3G6R3WOK_z_Rm7_FBZe.exe"
                                                                                    8⤵
                                                                                      PID:5300
                                                                                    • C:\Users\Admin\Pictures\Adobe Films\F7el0t34TK4CUBTle9uQqkRi.exe
                                                                                      "C:\Users\Admin\Pictures\Adobe Films\F7el0t34TK4CUBTle9uQqkRi.exe"
                                                                                      8⤵
                                                                                        PID:5412
                                                                                      • C:\Users\Admin\Pictures\Adobe Films\TwV_jQbydUybcucyJ6iyEO0X.exe
                                                                                        "C:\Users\Admin\Pictures\Adobe Films\TwV_jQbydUybcucyJ6iyEO0X.exe"
                                                                                        8⤵
                                                                                          PID:2096
                                                                                        • C:\Users\Admin\Pictures\Adobe Films\yOXB3nkta_SxemuFBpl9wJLa.exe
                                                                                          "C:\Users\Admin\Pictures\Adobe Films\yOXB3nkta_SxemuFBpl9wJLa.exe"
                                                                                          8⤵
                                                                                            PID:5700
                                                                                          • C:\Users\Admin\Pictures\Adobe Films\SKjXe_kPtqrg74xRjf_DgKs7.exe
                                                                                            "C:\Users\Admin\Pictures\Adobe Films\SKjXe_kPtqrg74xRjf_DgKs7.exe"
                                                                                            8⤵
                                                                                              PID:5772
                                                                                            • C:\Users\Admin\Pictures\Adobe Films\PRWbXeG_e49zfrixmPVq8gvD.exe
                                                                                              "C:\Users\Admin\Pictures\Adobe Films\PRWbXeG_e49zfrixmPVq8gvD.exe"
                                                                                              8⤵
                                                                                                PID:1844
                                                                                              • C:\Users\Admin\Pictures\Adobe Films\EUeuyhxSpEl4R4e9nmZ5absb.exe
                                                                                                "C:\Users\Admin\Pictures\Adobe Films\EUeuyhxSpEl4R4e9nmZ5absb.exe"
                                                                                                8⤵
                                                                                                  PID:5900
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                                7⤵
                                                                                                • Creates scheduled task(s)
                                                                                                PID:5112
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                                7⤵
                                                                                                • Creates scheduled task(s)
                                                                                                PID:2372
                                                                                            • C:\Users\Admin\Pictures\Adobe Films\XJ7SXEC77vQckQGIU_GL3Zfn.exe
                                                                                              "C:\Users\Admin\Pictures\Adobe Films\XJ7SXEC77vQckQGIU_GL3Zfn.exe"
                                                                                              6⤵
                                                                                                PID:3040
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 664
                                                                                                  7⤵
                                                                                                  • Program crash
                                                                                                  PID:5968
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 684
                                                                                                  7⤵
                                                                                                  • Program crash
                                                                                                  PID:2364
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 648
                                                                                                  7⤵
                                                                                                  • Program crash
                                                                                                  PID:4832
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 672
                                                                                                  7⤵
                                                                                                  • Program crash
                                                                                                  PID:5512
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 1128
                                                                                                  7⤵
                                                                                                  • Program crash
                                                                                                  PID:5412
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 1152
                                                                                                  7⤵
                                                                                                  • Program crash
                                                                                                  PID:5204
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 1164
                                                                                                  7⤵
                                                                                                  • Program crash
                                                                                                  PID:1244
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 1204
                                                                                                  7⤵
                                                                                                  • Program crash
                                                                                                  PID:5896
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 1248
                                                                                                  7⤵
                                                                                                  • Program crash
                                                                                                  PID:3712
                                                                                              • C:\Users\Admin\Pictures\Adobe Films\BT7F_kmCMbgKkDFJccuR4z3Y.exe
                                                                                                "C:\Users\Admin\Pictures\Adobe Films\BT7F_kmCMbgKkDFJccuR4z3Y.exe"
                                                                                                6⤵
                                                                                                  PID:3252
                                                                                                • C:\Users\Admin\Pictures\Adobe Films\nG2X8jGYVrEUxz6iT84iWF2O.exe
                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\nG2X8jGYVrEUxz6iT84iWF2O.exe"
                                                                                                  6⤵
                                                                                                    PID:3080
                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\pYRT_dCZOM5p5OZbCGX6CKLq.exe
                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\pYRT_dCZOM5p5OZbCGX6CKLq.exe"
                                                                                                    6⤵
                                                                                                      PID:3096
                                                                                                      • C:\Users\Admin\AppData\Local\ab97ab4e-78b4-436a-a485-402b911fbaaa.exe
                                                                                                        "C:\Users\Admin\AppData\Local\ab97ab4e-78b4-436a-a485-402b911fbaaa.exe"
                                                                                                        7⤵
                                                                                                          PID:4380
                                                                                                        • C:\Users\Admin\AppData\Local\c09b64db-2e1a-4915-b84d-e2ab5ac5d552.exe
                                                                                                          "C:\Users\Admin\AppData\Local\c09b64db-2e1a-4915-b84d-e2ab5ac5d552.exe"
                                                                                                          7⤵
                                                                                                            PID:3680
                                                                                                          • C:\Users\Admin\AppData\Local\d10271ea-457f-4556-92e0-79e8095b8cfa.exe
                                                                                                            "C:\Users\Admin\AppData\Local\d10271ea-457f-4556-92e0-79e8095b8cfa.exe"
                                                                                                            7⤵
                                                                                                              PID:1088
                                                                                                            • C:\Users\Admin\AppData\Local\a357f801-3c88-4b94-9bf3-404a9f0e16d3.exe
                                                                                                              "C:\Users\Admin\AppData\Local\a357f801-3c88-4b94-9bf3-404a9f0e16d3.exe"
                                                                                                              7⤵
                                                                                                                PID:4956
                                                                                                                • C:\Users\Admin\AppData\Roaming\7111090.exe
                                                                                                                  "C:\Users\Admin\AppData\Roaming\7111090.exe"
                                                                                                                  8⤵
                                                                                                                    PID:1228
                                                                                                                    • C:\Windows\SysWOW64\control.exe
                                                                                                                      "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\EdRGQQA5.cPl",
                                                                                                                      9⤵
                                                                                                                        PID:1660
                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                          "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\EdRGQQA5.cPl",
                                                                                                                          10⤵
                                                                                                                            PID:1712
                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\YxrFKSlebSAGFqC7TPFcGLBl.exe
                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\YxrFKSlebSAGFqC7TPFcGLBl.exe"
                                                                                                                    6⤵
                                                                                                                      PID:1672
                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\g4UUpKssKWXdqLOan6IOwaKf.exe
                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\g4UUpKssKWXdqLOan6IOwaKf.exe"
                                                                                                                      6⤵
                                                                                                                        PID:4956
                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\j4mXixRkNIxqO2p2ngZgWGTY.exe
                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\j4mXixRkNIxqO2p2ngZgWGTY.exe"
                                                                                                                        6⤵
                                                                                                                          PID:68
                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\UNuXqLGbReKTbayd8HYIArIf.exe
                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\UNuXqLGbReKTbayd8HYIArIf.exe"
                                                                                                                          6⤵
                                                                                                                            PID:5176
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC59E.tmp\Install.exe
                                                                                                                              .\Install.exe
                                                                                                                              7⤵
                                                                                                                                PID:5756
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSE635.tmp\Install.exe
                                                                                                                                  .\Install.exe /S /site_id "525403"
                                                                                                                                  8⤵
                                                                                                                                    PID:5268
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
                                                                                                                                      9⤵
                                                                                                                                        PID:1876
                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                                          10⤵
                                                                                                                                            PID:5960
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                              11⤵
                                                                                                                                                PID:4660
                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                  12⤵
                                                                                                                                                    PID:5152
                                                                                                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                      "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                                                      13⤵
                                                                                                                                                        PID:5980
                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                                                                                                                9⤵
                                                                                                                                                  PID:6052
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                                                                                                                    10⤵
                                                                                                                                                      PID:6032
                                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                                                                                                                        11⤵
                                                                                                                                                          PID:6100
                                                                                                                                                        • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                                                                                                                                          11⤵
                                                                                                                                                            PID:5204
                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                                                                                                                        9⤵
                                                                                                                                                          PID:5412
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                                                                                                            10⤵
                                                                                                                                                              PID:6104
                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                                                                                                                11⤵
                                                                                                                                                                  PID:4736
                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                                                                                                                  11⤵
                                                                                                                                                                    PID:2860
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /CREATE /TN "gWQSZAlZZ" /SC once /ST 00:11:00 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                                9⤵
                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                PID:5628
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /run /I /tn "gWQSZAlZZ"
                                                                                                                                                                9⤵
                                                                                                                                                                  PID:4448
                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                  schtasks /DELETE /F /TN "gWQSZAlZZ"
                                                                                                                                                                  9⤵
                                                                                                                                                                    PID:4744
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    schtasks /CREATE /TN "brIuwqybiEKAwdpiwj" /SC once /ST 00:14:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\WUUWFJqnKFeOpXCaR\eeNammEZxjaGeaJ\twLMTLb.exe\" AP /site_id 525403 /S" /V1 /F
                                                                                                                                                                    9⤵
                                                                                                                                                                    • Creates scheduled task(s)
                                                                                                                                                                    PID:5832
                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\r9DMnfO48zyarr1eSE05LKzv.exe
                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\r9DMnfO48zyarr1eSE05LKzv.exe"
                                                                                                                                                              6⤵
                                                                                                                                                                PID:5224
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:3720
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                    7⤵
                                                                                                                                                                      PID:1972
                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\D2Qp411Ip8Z8_YULGOLDIuxE.exe
                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\D2Qp411Ip8Z8_YULGOLDIuxE.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:5248
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\famX9DdWO4X74\EasyCalc License Agreement.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\famX9DdWO4X74\EasyCalc License Agreement.exe"
                                                                                                                                                                        7⤵
                                                                                                                                                                          PID:5528
                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\oiMnaMCq7Lm7jKcpXTWF7BNM.exe
                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\oiMnaMCq7Lm7jKcpXTWF7BNM.exe"
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:5392
                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\tbORYp8muUpVGEdITgK3MR5G.exe
                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\tbORYp8muUpVGEdITgK3MR5G.exe"
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:5428
                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5428 -s 400
                                                                                                                                                                              7⤵
                                                                                                                                                                              • Program crash
                                                                                                                                                                              PID:5908
                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\xagH64Ef3y2u2ETT27IWnKJR.exe
                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\xagH64Ef3y2u2ETT27IWnKJR.exe"
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:5480
                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\xagH64Ef3y2u2ETT27IWnKJR.exe
                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\xagH64Ef3y2u2ETT27IWnKJR.exe"
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:6108
                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\2x2ks0IMQgbM_mfoS1XyMUyX.exe
                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\2x2ks0IMQgbM_mfoS1XyMUyX.exe"
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:5456
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 400
                                                                                                                                                                                    7⤵
                                                                                                                                                                                    • Program crash
                                                                                                                                                                                    PID:5916
                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\pByBOI1Ghz2wjskbQr3OjHjA.exe
                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\pByBOI1Ghz2wjskbQr3OjHjA.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:5540
                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\vSZDGJfcSXqtsZ10Kd1r8z8e.exe
                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\vSZDGJfcSXqtsZ10Kd1r8z8e.exe"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:5644
                                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:3412
                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:5336
                                                                                                                                                                                          • C:\Windows\System32\netsh.exe
                                                                                                                                                                                            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                            7⤵
                                                                                                                                                                                              PID:5944
                                                                                                                                                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                              schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                                                                                                                                                                              7⤵
                                                                                                                                                                                              • Creates scheduled task(s)
                                                                                                                                                                                              PID:4248
                                                                                                                                                                                            • C:\Windows\System\svchost.exe
                                                                                                                                                                                              "C:\Windows\System\svchost.exe" formal
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:2600
                                                                                                                                                                                              • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:4664
                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\nPgwknobT1e80SNU9uwUZkW3.exe
                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\nPgwknobT1e80SNU9uwUZkW3.exe"
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:5580
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Fri0550507893048c.exe
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:1608
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c Fri05c25ad4f6fe4.exe
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:1244
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Fri05cac54300eb.exe
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:2492
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c Fri059521701074cbcde.exe
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:2480
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c Fri0519054cecb36fc1b.exe
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:1604
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c Fri058313bd59e.exe
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:3260
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri058313bd59e.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri058313bd59e.exe" -u
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:5060
                                                                                                                                                                                                    • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                      "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\KGG6K.cpL",
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:2896
                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                          "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\KGG6K.cpL",
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2324
                                                                                                                                                                                                            • C:\Windows\system32\RunDll32.exe
                                                                                                                                                                                                              C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\KGG6K.cpL",
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:2260
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri05e80376d7965136.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri05e80376d7965136.exe" /SILENT
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:1184
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-ONRNR.tmp\Fri05e80376d7965136.tmp
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-ONRNR.tmp\Fri05e80376d7965136.tmp" /SL5="$20202,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri05e80376d7965136.exe" /SILENT
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1800
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-OKQDM.tmp\windllhost.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-OKQDM.tmp\windllhost.exe" 77
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:2504
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri05c25ad4f6fe4.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri05c25ad4f6fe4.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:2292
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri0573351d0136.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri0573351d0136.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:1872
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:3388
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mystnnewfile.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mystnnewfile.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1628
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\inst.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\inst.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:4328
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\compan.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\compan.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:4828
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Skype.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Skype.exe
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:3916
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RobCleanerInstll31828.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RobCleanerInstll31828.exe"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:4288
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\7c5832ae-0a76-4fe3-94c7-2764cb0ce5b5.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\7c5832ae-0a76-4fe3-94c7-2764cb0ce5b5.exe"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:2484
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\b833b94a-993e-4b3b-8471-d11c0968483b.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\b833b94a-993e-4b3b-8471-d11c0968483b.exe"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:4212
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\ce25f743-2ca1-47b7-b499-837a5deaaeab.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\ce25f743-2ca1-47b7-b499-837a5deaaeab.exe"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:2680
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\b00766f6-af54-4d3d-b337-cadc85817024.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\b00766f6-af54-4d3d-b337-cadc85817024.exe"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:3588
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\5718271.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\5718271.exe"
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:4384
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\EdRGQQA5.cPl",
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:1964
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\EdRGQQA5.cPl",
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                        PID:3336
                                                                                                                                                                                                                                                        • C:\Windows\system32\RunDll32.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\EdRGQQA5.cPl",
                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                            PID:2364
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\EdRGQQA5.cPl",
                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                PID:5204
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\3b8f80a4-e9d1-4f29-99cb-d45b6424556b.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\3b8f80a4-e9d1-4f29-99cb-d45b6424556b.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:2896
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri059521701074cbcde.exe
                                                                                                                                                                                                                                                    Fri059521701074cbcde.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:3860
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri05cac54300eb.exe
                                                                                                                                                                                                                                                    Fri05cac54300eb.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                    PID:3968
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:5116
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                          taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                          PID:1228
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:2180
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im "Fri0510f5b933f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri0510f5b933f.exe" & exit
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:5040
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                            taskkill /im "Fri0510f5b933f.exe" /f
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                            PID:1404
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri0510f5b933f.exe
                                                                                                                                                                                                                                                          Fri0510f5b933f.exe /mixtwo
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:2660
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri0550507893048c.exe
                                                                                                                                                                                                                                                          Fri0550507893048c.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:2648
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri058313bd59e.exe
                                                                                                                                                                                                                                                          Fri058313bd59e.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:2484
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri0519054cecb36fc1b.exe
                                                                                                                                                                                                                                                            Fri0519054cecb36fc1b.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:2468
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8EE8A195\Fri05c25ad4f6fe4.exe
                                                                                                                                                                                                                                                            Fri05c25ad4f6fe4.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:1440
                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                            PID:3960
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:2116
                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:4272
                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:5136

                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                      • memory/500-185-0x0000000000D20000-0x0000000000D21000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/500-180-0x0000000000D20000-0x0000000000D21000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/508-276-0x0000000007E30000-0x0000000008180000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                                      • memory/508-228-0x0000000006E60000-0x0000000006E61000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/508-294-0x0000000007D30000-0x0000000007D4C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        112KB

                                                                                                                                                                                                                                                                      • memory/508-232-0x00000000074A0000-0x0000000007AC8000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/508-222-0x0000000006D70000-0x0000000006DA6000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        216KB

                                                                                                                                                                                                                                                                      • memory/508-194-0x0000000001230000-0x0000000001231000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/508-257-0x0000000007470000-0x0000000007492000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                                                      • memory/508-351-0x0000000001230000-0x0000000001231000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/508-267-0x0000000007D60000-0x0000000007DC6000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                                                      • memory/508-231-0x0000000006E62000-0x0000000006E63000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/508-270-0x0000000007AD0000-0x0000000007B36000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                                                      • memory/508-203-0x0000000001230000-0x0000000001231000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/508-297-0x0000000007DD0000-0x0000000007E1B000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        300KB

                                                                                                                                                                                                                                                                      • memory/900-196-0x00000000011A0000-0x00000000011A1000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/900-342-0x00000000011A0000-0x00000000011A1000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/900-296-0x0000000007E40000-0x0000000007E8B000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        300KB

                                                                                                                                                                                                                                                                      • memory/900-204-0x00000000011A0000-0x00000000011A1000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/900-269-0x0000000007EA0000-0x0000000007F06000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                                                      • memory/900-271-0x0000000007C20000-0x0000000007C86000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        408KB

                                                                                                                                                                                                                                                                      • memory/900-265-0x0000000007E00000-0x0000000007E22000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        136KB

                                                                                                                                                                                                                                                                      • memory/900-274-0x0000000007F10000-0x0000000008260000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        3.3MB

                                                                                                                                                                                                                                                                      • memory/900-219-0x0000000006EA0000-0x0000000006EA1000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/900-236-0x0000000006EA2000-0x0000000006EA3000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/900-221-0x0000000006EB0000-0x0000000006EE6000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        216KB

                                                                                                                                                                                                                                                                      • memory/900-292-0x0000000007CB0000-0x0000000007CCC000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        112KB

                                                                                                                                                                                                                                                                      • memory/900-230-0x0000000007520000-0x0000000007B48000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/1120-211-0x000000001B590000-0x000000001B592000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                      • memory/1120-193-0x0000000000A40000-0x0000000000A48000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        32KB

                                                                                                                                                                                                                                                                      • memory/1120-200-0x0000000000A40000-0x0000000000A48000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        32KB

                                                                                                                                                                                                                                                                      • memory/1184-261-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        816KB

                                                                                                                                                                                                                                                                      • memory/1272-220-0x0000000000A60000-0x0000000000A7C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        112KB

                                                                                                                                                                                                                                                                      • memory/1272-233-0x0000000000E90000-0x0000000000E96000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        24KB

                                                                                                                                                                                                                                                                      • memory/1272-254-0x000000001B7A0000-0x000000001B7A2000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                                      • memory/1272-212-0x0000000000A60000-0x0000000000A7C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        112KB

                                                                                                                                                                                                                                                                      • memory/1440-224-0x0000000000A50000-0x0000000000ADC000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        560KB

                                                                                                                                                                                                                                                                      • memory/1440-266-0x0000000005B50000-0x000000000604E000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        5.0MB

                                                                                                                                                                                                                                                                      • memory/1440-238-0x00000000052C0000-0x0000000005336000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        472KB

                                                                                                                                                                                                                                                                      • memory/1440-248-0x00000000052A0000-0x00000000052BE000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                                      • memory/1440-216-0x0000000000A50000-0x0000000000ADC000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        560KB

                                                                                                                                                                                                                                                                      • memory/1440-252-0x0000000005220000-0x0000000005221000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/1440-251-0x00000000053C0000-0x00000000053C1000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/1628-442-0x0000000000737000-0x0000000000763000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        176KB

                                                                                                                                                                                                                                                                      • memory/1792-132-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        100KB

                                                                                                                                                                                                                                                                      • memory/1792-134-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        572KB

                                                                                                                                                                                                                                                                      • memory/1792-143-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        152KB

                                                                                                                                                                                                                                                                      • memory/1792-142-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1.5MB

                                                                                                                                                                                                                                                                      • memory/1792-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        100KB

                                                                                                                                                                                                                                                                      • memory/1792-141-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1.5MB

                                                                                                                                                                                                                                                                      • memory/1792-136-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        572KB

                                                                                                                                                                                                                                                                      • memory/1792-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1.5MB

                                                                                                                                                                                                                                                                      • memory/1792-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1.5MB

                                                                                                                                                                                                                                                                      • memory/1792-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        572KB

                                                                                                                                                                                                                                                                      • memory/1792-138-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        100KB

                                                                                                                                                                                                                                                                      • memory/1792-135-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        100KB

                                                                                                                                                                                                                                                                      • memory/1800-278-0x0000000000900000-0x0000000000901000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/1872-307-0x0000000005750000-0x000000000585A000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1.0MB

                                                                                                                                                                                                                                                                      • memory/1872-302-0x0000000005620000-0x0000000005632000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                                                                      • memory/1872-290-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                                                                      • memory/1872-309-0x0000000005680000-0x00000000056BE000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        248KB

                                                                                                                                                                                                                                                                      • memory/1872-300-0x0000000005BB0000-0x00000000061B6000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.0MB

                                                                                                                                                                                                                                                                      • memory/1872-293-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                                                                      • memory/1872-287-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                                                                      • memory/1984-256-0x0000000000690000-0x000000000073E000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        696KB

                                                                                                                                                                                                                                                                      • memory/2180-306-0x0000000000400000-0x0000000000455000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        340KB

                                                                                                                                                                                                                                                                      • memory/2292-295-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                                                                      • memory/2292-308-0x0000000005060000-0x000000000509E000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        248KB

                                                                                                                                                                                                                                                                      • memory/2292-301-0x00000000029A0000-0x00000000029B2000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                                                                      • memory/2292-284-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                                                                      • memory/2292-303-0x0000000005130000-0x000000000523A000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1.0MB

                                                                                                                                                                                                                                                                      • memory/2292-291-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                                                                      • memory/2292-298-0x0000000005630000-0x0000000005C36000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.0MB

                                                                                                                                                                                                                                                                      • memory/2648-217-0x00000000003B0000-0x00000000003B1000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/2648-223-0x00000000003B0000-0x00000000003B1000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/2660-209-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        320KB

                                                                                                                                                                                                                                                                      • memory/2660-235-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        320KB

                                                                                                                                                                                                                                                                      • memory/3096-206-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        816KB

                                                                                                                                                                                                                                                                      • memory/3280-353-0x0000000074DD0000-0x0000000074EC1000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        964KB

                                                                                                                                                                                                                                                                      • memory/3280-339-0x0000000000CF0000-0x0000000000E44000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1.3MB

                                                                                                                                                                                                                                                                      • memory/3280-390-0x00000000730D0000-0x000000007311B000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        300KB

                                                                                                                                                                                                                                                                      • memory/3280-359-0x000000006FE50000-0x000000006FED0000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        512KB

                                                                                                                                                                                                                                                                      • memory/3280-344-0x0000000000C50000-0x0000000000C51000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/3280-381-0x0000000075430000-0x0000000076778000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        19.3MB

                                                                                                                                                                                                                                                                      • memory/3280-349-0x0000000073BF0000-0x0000000073DB2000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1.8MB

                                                                                                                                                                                                                                                                      • memory/3280-374-0x0000000074020000-0x00000000745A4000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        5.5MB

                                                                                                                                                                                                                                                                      • memory/3388-283-0x00000000005E0000-0x000000000079C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1.7MB

                                                                                                                                                                                                                                                                      • memory/3388-282-0x00000000005E0000-0x000000000079C000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1.7MB

                                                                                                                                                                                                                                                                      • memory/3860-392-0x00000000007B6000-0x00000000007C6000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                                      • memory/4324-446-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/4324-448-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/4884-245-0x0000000000C20000-0x0000000000CAA000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        552KB

                                                                                                                                                                                                                                                                      • memory/4884-268-0x0000000005AF0000-0x0000000005FEE000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        5.0MB

                                                                                                                                                                                                                                                                      • memory/4884-263-0x00000000013B0000-0x00000000013B1000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/4884-246-0x0000000000C20000-0x0000000000CAA000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        552KB

                                                                                                                                                                                                                                                                      • memory/4884-253-0x0000000002E10000-0x0000000002E2E000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        120KB

                                                                                                                                                                                                                                                                      • memory/4884-250-0x0000000005570000-0x00000000055E6000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        472KB

                                                                                                                                                                                                                                                                      • memory/4884-258-0x0000000005560000-0x0000000005561000-memory.dmp

                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB