asyncrat | 0a8e413babd867a1bdbbdba1e7c56643c9e13d5d26a6d803c7846f2af201936c

Analysis

max time kernel
600s
max time network
605s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
14-10-2022 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

T00WKSAU002DHSRQW_002.exe
Size

300.0MB
MD5

707a86802d4275cda27b6e989b691e0a
SHA1

5eb007b7e7f3ac28363329904493e443a15cdabf
SHA256

0a8e413babd867a1bdbbdba1e7c56643c9e13d5d26a6d803c7846f2af201936c
SHA512

511a407bedd29e7b69d03a031d16a1f0d46e2ce789065bfc427ef296e3c090d2cf2d5d1757533b5c70d3935f2baf1686b1618df11548f1ea7478d8ede88edb60
SSDEEP

3072:rvOIfhz+4a0+9bdRvixoww6r50iis79KfTYVY:hA10+9HvQ15Fjod

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

thoe409.duckdns.org:6739

thoe409.duckdns.org:7301

thoe409.duckdns.org:7808

thoe409.duckdns.org:8333

thoe409.duckdns.org:6112

thoe409.duckdns.org:7553

thoe409.duckdns.org:6443

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 23 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/5052-208-0x000000000040C78E-mapping.dmp	asyncrat
behavioral2/memory/5052-257-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/200-384-0x000000000040C78E-mapping.dmp	asyncrat
behavioral2/memory/4884-524-0x000000000040C78E-mapping.dmp	asyncrat
behavioral2/memory/5052-634-0x0000000006210000-0x0000000006232000-memory.dmp	asyncrat
behavioral2/memory/5052-635-0x0000000006E70000-0x0000000006E92000-memory.dmp	asyncrat
behavioral2/memory/5052-637-0x00000000075D0000-0x00000000075F2000-memory.dmp	asyncrat
behavioral2/memory/5052-640-0x0000000007BA0000-0x0000000007BC2000-memory.dmp	asyncrat
behavioral2/memory/5052-642-0x0000000008EB0000-0x0000000008ED2000-memory.dmp	asyncrat
behavioral2/memory/5052-675-0x0000000007E00000-0x0000000007E22000-memory.dmp	asyncrat
behavioral2/memory/5052-664-0x0000000007A10000-0x0000000007A32000-memory.dmp	asyncrat
behavioral2/memory/5052-679-0x0000000008070000-0x0000000008092000-memory.dmp	asyncrat
behavioral2/memory/5052-670-0x00000000079A0000-0x00000000079C2000-memory.dmp	asyncrat
behavioral2/memory/5052-730-0x0000000007FC0000-0x0000000007FE2000-memory.dmp	asyncrat
behavioral2/memory/5052-738-0x0000000008550000-0x0000000008572000-memory.dmp	asyncrat
behavioral2/memory/5052-796-0x0000000008170000-0x0000000008192000-memory.dmp	asyncrat
behavioral2/memory/5052-826-0x0000000007AF0000-0x0000000007B12000-memory.dmp	asyncrat
behavioral2/memory/5052-885-0x0000000007CB0000-0x0000000007CD2000-memory.dmp	asyncrat
behavioral2/memory/5052-895-0x0000000007E90000-0x0000000007EB2000-memory.dmp	asyncrat
behavioral2/memory/5052-879-0x0000000002B40000-0x0000000002B62000-memory.dmp	asyncrat
behavioral2/memory/5052-883-0x00000000078B0000-0x00000000078D2000-memory.dmp	asyncrat
behavioral2/memory/5052-931-0x0000000008590000-0x00000000085B2000-memory.dmp	asyncrat
behavioral2/memory/5052-946-0x0000000007DB0000-0x0000000007DD2000-memory.dmp	asyncrat

Executes dropped EXE 9 IoCs

Processes:

dbcd.exedbcd.exedbcd.exedbcd.exedbcd.exedbcd.exedbcd.exedbcd.exedbcd.exe

pid process

4124 dbcd.exe
4372 dbcd.exe
4836 dbcd.exe
1352 dbcd.exe
980 dbcd.exe
3100 dbcd.exe
4536 dbcd.exe
1012 dbcd.exe
4248 dbcd.exe

pid	process
4124	dbcd.exe
4372	dbcd.exe
4836	dbcd.exe
1352	dbcd.exe
980	dbcd.exe
3100	dbcd.exe
4536	dbcd.exe
1012	dbcd.exe
4248	dbcd.exe

Suspicious use of SetThreadContext 9 IoCs

Processes:

T00WKSAU002DHSRQW_002.exedbcd.exedbcd.exedbcd.exedbcd.exedbcd.exedbcd.exedbcd.exedbcd.exe

description	pid	process	target process
PID 1484 set thread context of 5052	1484	T00WKSAU002DHSRQW_002.exe	RegAsm.exe
PID 4124 set thread context of 200	4124	dbcd.exe	RegAsm.exe
PID 4372 set thread context of 4884	4372	dbcd.exe	RegAsm.exe
PID 4836 set thread context of 64	4836	dbcd.exe	RegAsm.exe
PID 1352 set thread context of 396	1352	dbcd.exe	RegAsm.exe
PID 980 set thread context of 4504	980	dbcd.exe	RegAsm.exe
PID 3100 set thread context of 4600	3100	dbcd.exe	RegAsm.exe
PID 4536 set thread context of 3820	4536	dbcd.exe	RegAsm.exe
PID 1012 set thread context of 1464	1012	dbcd.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4792	schtasks.exe
4060	schtasks.exe
4856	schtasks.exe
1872	schtasks.exe
4352	schtasks.exe
4656	schtasks.exe
4360	schtasks.exe
2932	schtasks.exe
908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

RegAsm.exe

pid	process
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe
5052	RegAsm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegAsm.exe

pid process

5052 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 5052 RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	5052	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

T00WKSAU002DHSRQW_002.execmd.exedbcd.execmd.exedbcd.execmd.exeRegAsm.exe

description	pid	process	target process
PID 1484 wrote to memory of 1656	1484	T00WKSAU002DHSRQW_002.exe	cmd.exe
PID 1484 wrote to memory of 1656	1484	T00WKSAU002DHSRQW_002.exe	cmd.exe
PID 1484 wrote to memory of 1656	1484	T00WKSAU002DHSRQW_002.exe	cmd.exe
PID 1484 wrote to memory of 4580	1484	T00WKSAU002DHSRQW_002.exe	cmd.exe
PID 1484 wrote to memory of 4580	1484	T00WKSAU002DHSRQW_002.exe	cmd.exe
PID 1484 wrote to memory of 4580	1484	T00WKSAU002DHSRQW_002.exe	cmd.exe
PID 1656 wrote to memory of 4856	1656	cmd.exe	schtasks.exe
PID 1656 wrote to memory of 4856	1656	cmd.exe	schtasks.exe
PID 1656 wrote to memory of 4856	1656	cmd.exe	schtasks.exe
PID 1484 wrote to memory of 5052	1484	T00WKSAU002DHSRQW_002.exe	RegAsm.exe
PID 1484 wrote to memory of 5052	1484	T00WKSAU002DHSRQW_002.exe	RegAsm.exe
PID 1484 wrote to memory of 5052	1484	T00WKSAU002DHSRQW_002.exe	RegAsm.exe
PID 1484 wrote to memory of 5052	1484	T00WKSAU002DHSRQW_002.exe	RegAsm.exe
PID 1484 wrote to memory of 5052	1484	T00WKSAU002DHSRQW_002.exe	RegAsm.exe
PID 1484 wrote to memory of 5052	1484	T00WKSAU002DHSRQW_002.exe	RegAsm.exe
PID 1484 wrote to memory of 5052	1484	T00WKSAU002DHSRQW_002.exe	RegAsm.exe
PID 1484 wrote to memory of 5052	1484	T00WKSAU002DHSRQW_002.exe	RegAsm.exe
PID 4124 wrote to memory of 2192	4124	dbcd.exe	cmd.exe
PID 4124 wrote to memory of 2192	4124	dbcd.exe	cmd.exe
PID 4124 wrote to memory of 2192	4124	dbcd.exe	cmd.exe
PID 4124 wrote to memory of 2768	4124	dbcd.exe	cmd.exe
PID 4124 wrote to memory of 2768	4124	dbcd.exe	cmd.exe
PID 4124 wrote to memory of 2768	4124	dbcd.exe	cmd.exe
PID 2192 wrote to memory of 1872	2192	cmd.exe	schtasks.exe
PID 2192 wrote to memory of 1872	2192	cmd.exe	schtasks.exe
PID 2192 wrote to memory of 1872	2192	cmd.exe	schtasks.exe
PID 4124 wrote to memory of 200	4124	dbcd.exe	RegAsm.exe
PID 4124 wrote to memory of 200	4124	dbcd.exe	RegAsm.exe
PID 4124 wrote to memory of 200	4124	dbcd.exe	RegAsm.exe
PID 4124 wrote to memory of 200	4124	dbcd.exe	RegAsm.exe
PID 4124 wrote to memory of 200	4124	dbcd.exe	RegAsm.exe
PID 4124 wrote to memory of 200	4124	dbcd.exe	RegAsm.exe
PID 4124 wrote to memory of 200	4124	dbcd.exe	RegAsm.exe
PID 4124 wrote to memory of 200	4124	dbcd.exe	RegAsm.exe
PID 4372 wrote to memory of 4552	4372	dbcd.exe	cmd.exe
PID 4372 wrote to memory of 4552	4372	dbcd.exe	cmd.exe
PID 4372 wrote to memory of 4552	4372	dbcd.exe	cmd.exe
PID 4552 wrote to memory of 4352	4552	cmd.exe	schtasks.exe
PID 4552 wrote to memory of 4352	4552	cmd.exe	schtasks.exe
PID 4552 wrote to memory of 4352	4552	cmd.exe	schtasks.exe
PID 4372 wrote to memory of 3884	4372	dbcd.exe	cmd.exe
PID 4372 wrote to memory of 3884	4372	dbcd.exe	cmd.exe
PID 4372 wrote to memory of 3884	4372	dbcd.exe	cmd.exe
PID 4372 wrote to memory of 4884	4372	dbcd.exe	RegAsm.exe
PID 4372 wrote to memory of 4884	4372	dbcd.exe	RegAsm.exe
PID 4372 wrote to memory of 4884	4372	dbcd.exe	RegAsm.exe
PID 4372 wrote to memory of 4884	4372	dbcd.exe	RegAsm.exe
PID 4372 wrote to memory of 4884	4372	dbcd.exe	RegAsm.exe
PID 4372 wrote to memory of 4884	4372	dbcd.exe	RegAsm.exe
PID 4372 wrote to memory of 4884	4372	dbcd.exe	RegAsm.exe
PID 4372 wrote to memory of 4884	4372	dbcd.exe	RegAsm.exe
PID 5052 wrote to memory of 1432	5052	RegAsm.exe	cmd.exe
PID 5052 wrote to memory of 1432	5052	RegAsm.exe	cmd.exe
PID 5052 wrote to memory of 1432	5052	RegAsm.exe	cmd.exe
PID 5052 wrote to memory of 2212	5052	RegAsm.exe	cmd.exe
PID 5052 wrote to memory of 2212	5052	RegAsm.exe	cmd.exe
PID 5052 wrote to memory of 2212	5052	RegAsm.exe	cmd.exe
PID 5052 wrote to memory of 2264	5052	RegAsm.exe	cmd.exe
PID 5052 wrote to memory of 2264	5052	RegAsm.exe	cmd.exe
PID 5052 wrote to memory of 2264	5052	RegAsm.exe	cmd.exe
PID 5052 wrote to memory of 440	5052	RegAsm.exe	cmd.exe
PID 5052 wrote to memory of 440	5052	RegAsm.exe	cmd.exe
PID 5052 wrote to memory of 440	5052	RegAsm.exe	cmd.exe
PID 5052 wrote to memory of 3812	5052	RegAsm.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\T00WKSAU002DHSRQW_002.exe
"C:\Users\Admin\AppData\Local\Temp\T00WKSAU002DHSRQW_002.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
3⤵
- Creates scheduled task(s)
PID:4856

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\T00WKSAU002DHSRQW_002.exe" "C:\Users\Admin\AppData\Roaming\dbcd.exe"
2⤵
PID:4580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5052

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\wxckff.vbs"' & exit
3⤵
PID:2940

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\wxckff.vbs"'
4⤵
PID:3824

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\bhjaum.vbs"' & exit
3⤵
PID:2836

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\bhjaum.vbs"'
4⤵
PID:4036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\wxckff.vbs"' & exit
3⤵
PID:1604

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\wxckff.vbs"'
4⤵
PID:4160

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\lmrgur.vbs"' & exit
3⤵
PID:1764

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\lmrgur.vbs"'
4⤵
PID:4896

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\nmmzok.vbs"' & exit
3⤵
PID:1752

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\nmmzok.vbs"'
4⤵
PID:2244

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\fphvkf.vbs"' & exit
3⤵
PID:1596

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\fphvkf.vbs"'
4⤵
PID:4676

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\fphvkf.vbs"' & exit
3⤵
PID:2408

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\fphvkf.vbs"'
4⤵
PID:4696

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\wxckff.vbs"' & exit
3⤵
PID:348

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\wxckff.vbs"'
4⤵
PID:4708

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\rvlufd.vbs"' & exit
3⤵
PID:2716

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\rvlufd.vbs"'
4⤵
PID:228

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\anqflc.vbs"' & exit
3⤵
PID:440

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\anqflc.vbs"'
4⤵
PID:4880

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\fphvkf.vbs"' & exit
3⤵
PID:3812

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\fphvkf.vbs"'
4⤵
PID:4220

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\vdywxe.vbs"' & exit
3⤵
PID:2212

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\vdywxe.vbs"'
4⤵
PID:1856

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\bhjaum.vbs"' & exit
3⤵
PID:2264

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\bhjaum.vbs"'
4⤵
PID:904

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\pamndj.vbs"' & exit
3⤵
PID:2916

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\pamndj.vbs"'
4⤵
PID:1384

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\nmmzok.vbs"' & exit
3⤵
PID:1432

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\nmmzok.vbs"'
4⤵
PID:5084

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tnvcnk.vbs"' & exit
3⤵
PID:4620

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tnvcnk.vbs"'
4⤵
PID:1176

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\khoclt.vbs"' & exit
3⤵
PID:4352

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\khoclt.vbs"'
4⤵
PID:4228

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\wsigsk.vbs"' & exit
3⤵
PID:4272

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\wsigsk.vbs"'
4⤵
PID:1304

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\mqefln.vbs"' & exit
3⤵
PID:1044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\mqefln.vbs"'
4⤵
PID:4968

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\pruraa.vbs"' & exit
3⤵
PID:652

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\pruraa.vbs"'
4⤵
PID:456

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\kbhxud.vbs"' & exit
3⤵
PID:4512

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\kbhxud.vbs"'
4⤵
PID:3952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\fewmlr.vbs"' & exit
3⤵
PID:2352

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\fewmlr.vbs"'
4⤵
PID:388

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\rupiiv.vbs"' & exit
3⤵
PID:2412

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\rupiiv.vbs"'
4⤵
PID:1776

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\rupiiv.vbs"' & exit
3⤵
PID:1692

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\rupiiv.vbs"'
4⤵
PID:4288

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\pvskqn.vbs"' & exit
3⤵
PID:3968

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\pvskqn.vbs"'
4⤵
PID:188

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\cbrcff.vbs"' & exit
3⤵
PID:2612

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\cbrcff.vbs"'
4⤵
PID:1248

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\pjuzme.vbs"' & exit
3⤵
PID:4840

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\pjuzme.vbs"'
4⤵
PID:1332

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\pjuzme.vbs"' & exit
3⤵
PID:3580

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\pjuzme.vbs"'
4⤵
PID:4276

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\qjpshy.vbs"' & exit
3⤵
PID:4668

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\qjpshy.vbs"'
4⤵
PID:3176

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\nmqnrc.vbs"' & exit
3⤵
PID:3180

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\nmqnrc.vbs"'
4⤵
PID:2984

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\jmyvfb.vbs"' & exit
3⤵
PID:60

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\jmyvfb.vbs"'
4⤵
PID:4588

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ihgkuu.vbs"' & exit
3⤵
PID:1092

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ihgkuu.vbs"'
4⤵
PID:3832

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\dvkxoo.vbs"' & exit
3⤵
PID:5064

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\dvkxoo.vbs"'
4⤵
PID:2288

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\vbwzhm.vbs"' & exit
3⤵
PID:1944

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\vbwzhm.vbs"'
4⤵
PID:4532

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ucutky.vbs"' & exit
3⤵
PID:4456

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ucutky.vbs"'
4⤵
PID:3300

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\kgsqol.vbs"' & exit
3⤵
PID:4992

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\kgsqol.vbs"'
4⤵
PID:3416

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ylsoaq.vbs"' & exit
3⤵
PID:2164

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ylsoaq.vbs"'
4⤵
PID:4752

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\hncwnu.vbs"' & exit
3⤵
PID:4168

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\hncwnu.vbs"'
4⤵
PID:3184

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\gopyro.vbs"' & exit
3⤵
PID:708

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\gopyro.vbs"'
4⤵
PID:1496

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\gopyro.vbs"' & exit
3⤵
PID:1940

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\gopyro.vbs"'
4⤵
PID:4124

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\oefcfp.vbs"' & exit
3⤵
PID:4072

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\oefcfp.vbs"'
4⤵
PID:4140

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\sttxln.vbs"' & exit
3⤵
PID:1316

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\sttxln.vbs"'
4⤵
PID:4436

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ygkdmm.vbs"' & exit
3⤵
PID:3792

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ygkdmm.vbs"'
4⤵
PID:2404

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\bzaxnd.vbs"' & exit
3⤵
PID:1848

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\bzaxnd.vbs"'
4⤵
PID:4316

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\rxvwhh.vbs"' & exit
3⤵
PID:3516

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\rxvwhh.vbs"'
4⤵
PID:1880

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\navlux.vbs"' & exit
3⤵
PID:3248

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\navlux.vbs"'
4⤵
PID:1688

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\diqbox.vbs"' & exit
3⤵
PID:3688

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\diqbox.vbs"'
4⤵
PID:5048

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\pouaiv.vbs"' & exit
3⤵
PID:3704

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\pouaiv.vbs"'
4⤵
PID:1908

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\diqbox.vbs"' & exit
3⤵
PID:2768

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\diqbox.vbs"'
4⤵
PID:5008

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\psrsyj.vbs"' & exit
3⤵
PID:2936

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\psrsyj.vbs"'
4⤵
PID:4912

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\kpacyg.vbs"' & exit
3⤵
PID:4616

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\kpacyg.vbs"'
4⤵
PID:3980

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\eyldhu.vbs"' & exit
3⤵
PID:3864

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\eyldhu.vbs"'
4⤵
PID:720

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tlwtbj.vbs"' & exit
3⤵
PID:3600

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tlwtbj.vbs"'
4⤵
PID:4820

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\qdtrfk.vbs"' & exit
3⤵
PID:4596

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\qdtrfk.vbs"'
4⤵
PID:4680

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\oifdbg.vbs"' & exit
3⤵
PID:1452

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\oifdbg.vbs"'
4⤵
PID:4908

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\oyagud.vbs"' & exit
3⤵
PID:4956

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\oyagud.vbs"'
4⤵
PID:2256

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\piawva.vbs"' & exit
3⤵
PID:4196

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\piawva.vbs"'
4⤵
PID:4232

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\caxylm.vbs"' & exit
3⤵
PID:4944

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\caxylm.vbs"'
4⤵
PID:8

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\kzwpmx.vbs"' & exit
3⤵
PID:5072

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\kzwpmx.vbs"'
4⤵
PID:1256

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\zqpquq.vbs"' & exit
3⤵
PID:4480

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\zqpquq.vbs"'
4⤵
PID:2556

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\zxepjv.vbs"' & exit
3⤵
PID:4916

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\zxepjv.vbs"'
4⤵
PID:2400

C:\Users\Admin\AppData\Roaming\dbcd.exe
C:\Users\Admin\AppData\Roaming\dbcd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4124

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
3⤵
- Creates scheduled task(s)
PID:1872

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\dbcd.exe" "C:\Users\Admin\AppData\Roaming\dbcd.exe"
2⤵
PID:2768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:200

C:\Users\Admin\AppData\Roaming\dbcd.exe
C:\Users\Admin\AppData\Roaming\dbcd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4372

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:4552

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
3⤵
- Creates scheduled task(s)
PID:4352

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\dbcd.exe" "C:\Users\Admin\AppData\Roaming\dbcd.exe"
2⤵
PID:3884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4884

C:\Users\Admin\AppData\Roaming\dbcd.exe
C:\Users\Admin\AppData\Roaming\dbcd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4836

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
2⤵
PID:780

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
3⤵
- Creates scheduled task(s)
PID:4656

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\dbcd.exe" "C:\Users\Admin\AppData\Roaming\dbcd.exe"
2⤵
PID:3092

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:64

C:\Users\Admin\AppData\Roaming\dbcd.exe
C:\Users\Admin\AppData\Roaming\dbcd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1352

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
2⤵
PID:2168

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
3⤵
- Creates scheduled task(s)
PID:4360

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\dbcd.exe" "C:\Users\Admin\AppData\Roaming\dbcd.exe"
2⤵
PID:5068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:396

C:\Users\Admin\AppData\Roaming\dbcd.exe
C:\Users\Admin\AppData\Roaming\dbcd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:980

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
2⤵
PID:380

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
3⤵
- Creates scheduled task(s)
PID:908

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\dbcd.exe" "C:\Users\Admin\AppData\Roaming\dbcd.exe"
2⤵
PID:344

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4504

C:\Users\Admin\AppData\Roaming\dbcd.exe
C:\Users\Admin\AppData\Roaming\dbcd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3100

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
2⤵
PID:4964

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
3⤵
- Creates scheduled task(s)
PID:2932

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\dbcd.exe" "C:\Users\Admin\AppData\Roaming\dbcd.exe"
2⤵
PID:3828

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4600

C:\Users\Admin\AppData\Roaming\dbcd.exe
C:\Users\Admin\AppData\Roaming\dbcd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4536

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
2⤵
PID:4120

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
3⤵
- Creates scheduled task(s)
PID:4792

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\dbcd.exe" "C:\Users\Admin\AppData\Roaming\dbcd.exe"
2⤵
PID:2348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3820

C:\Users\Admin\AppData\Roaming\dbcd.exe
C:\Users\Admin\AppData\Roaming\dbcd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1012

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
2⤵
PID:1480

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\dbcd.exe'" /f
3⤵
- Creates scheduled task(s)
PID:4060

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\dbcd.exe" "C:\Users\Admin\AppData\Roaming\dbcd.exe"
2⤵
PID:1692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1464

C:\Users\Admin\AppData\Roaming\dbcd.exe
C:\Users\Admin\AppData\Roaming\dbcd.exe
1⤵
- Executes dropped EXE
PID:4248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
Filesize
425B

MD5
605f809fab8c19729d39d075f7ffdb53

SHA1
c546f877c9bd53563174a90312a8337fdfc5fdd9

SHA256
6904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556

SHA512
82cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dbcd.exe.log
Filesize
520B

MD5
f5a4ac8b07bce81c5d29a6701317315b

SHA1
b2a2b7735c475f5d30a2d94251b4d7c4f511a57e

SHA256
e6a1b02dd813c1f29bfd8361a4fc7ca6f24d2e41d5c3a66258cb66f3cb902f5a

SHA512
83a82932a9395f13e346a5e3e7fd27ed6d5fb6d32b6838107c24318add4c74f199d974d6f33acb0f6aa670a19a544c672f420249c792e336452ad37f304e7dc0

Download Submit
C:\Users\Admin\AppData\Roaming\dbcd.exe
Filesize
300.0MB

MD5
707a86802d4275cda27b6e989b691e0a

SHA1
5eb007b7e7f3ac28363329904493e443a15cdabf

SHA256
0a8e413babd867a1bdbbdba1e7c56643c9e13d5d26a6d803c7846f2af201936c

SHA512
511a407bedd29e7b69d03a031d16a1f0d46e2ce789065bfc427ef296e3c090d2cf2d5d1757533b5c70d3935f2baf1686b1618df11548f1ea7478d8ede88edb60

Download Submit
C:\Users\Admin\AppData\Roaming\dbcd.exe
Filesize
300.0MB

MD5
707a86802d4275cda27b6e989b691e0a

SHA1
5eb007b7e7f3ac28363329904493e443a15cdabf

SHA256
0a8e413babd867a1bdbbdba1e7c56643c9e13d5d26a6d803c7846f2af201936c

SHA512
511a407bedd29e7b69d03a031d16a1f0d46e2ce789065bfc427ef296e3c090d2cf2d5d1757533b5c70d3935f2baf1686b1618df11548f1ea7478d8ede88edb60

Download Submit
C:\Users\Admin\AppData\Roaming\dbcd.exe
Filesize
300.0MB

MD5
707a86802d4275cda27b6e989b691e0a

SHA1
5eb007b7e7f3ac28363329904493e443a15cdabf

SHA256
0a8e413babd867a1bdbbdba1e7c56643c9e13d5d26a6d803c7846f2af201936c

SHA512
511a407bedd29e7b69d03a031d16a1f0d46e2ce789065bfc427ef296e3c090d2cf2d5d1757533b5c70d3935f2baf1686b1618df11548f1ea7478d8ede88edb60

Download Submit
C:\Users\Admin\AppData\Roaming\dbcd.exe
Filesize
300.0MB

MD5
707a86802d4275cda27b6e989b691e0a

SHA1
5eb007b7e7f3ac28363329904493e443a15cdabf

SHA256
0a8e413babd867a1bdbbdba1e7c56643c9e13d5d26a6d803c7846f2af201936c

SHA512
511a407bedd29e7b69d03a031d16a1f0d46e2ce789065bfc427ef296e3c090d2cf2d5d1757533b5c70d3935f2baf1686b1618df11548f1ea7478d8ede88edb60

Download Submit
C:\Users\Admin\AppData\Roaming\dbcd.exe
Filesize
300.0MB

MD5
707a86802d4275cda27b6e989b691e0a

SHA1
5eb007b7e7f3ac28363329904493e443a15cdabf

SHA256
0a8e413babd867a1bdbbdba1e7c56643c9e13d5d26a6d803c7846f2af201936c

SHA512
511a407bedd29e7b69d03a031d16a1f0d46e2ce789065bfc427ef296e3c090d2cf2d5d1757533b5c70d3935f2baf1686b1618df11548f1ea7478d8ede88edb60

Download Submit
C:\Users\Admin\AppData\Roaming\dbcd.exe
Filesize
300.0MB

MD5
707a86802d4275cda27b6e989b691e0a

SHA1
5eb007b7e7f3ac28363329904493e443a15cdabf

SHA256
0a8e413babd867a1bdbbdba1e7c56643c9e13d5d26a6d803c7846f2af201936c

SHA512
511a407bedd29e7b69d03a031d16a1f0d46e2ce789065bfc427ef296e3c090d2cf2d5d1757533b5c70d3935f2baf1686b1618df11548f1ea7478d8ede88edb60

Download Submit
C:\Users\Admin\AppData\Roaming\dbcd.exe
Filesize
300.0MB

MD5
707a86802d4275cda27b6e989b691e0a

SHA1
5eb007b7e7f3ac28363329904493e443a15cdabf

SHA256
0a8e413babd867a1bdbbdba1e7c56643c9e13d5d26a6d803c7846f2af201936c

SHA512
511a407bedd29e7b69d03a031d16a1f0d46e2ce789065bfc427ef296e3c090d2cf2d5d1757533b5c70d3935f2baf1686b1618df11548f1ea7478d8ede88edb60

Download Submit
C:\Users\Admin\AppData\Roaming\dbcd.exe
Filesize
300.0MB

MD5
707a86802d4275cda27b6e989b691e0a

SHA1
5eb007b7e7f3ac28363329904493e443a15cdabf

SHA256
0a8e413babd867a1bdbbdba1e7c56643c9e13d5d26a6d803c7846f2af201936c

SHA512
511a407bedd29e7b69d03a031d16a1f0d46e2ce789065bfc427ef296e3c090d2cf2d5d1757533b5c70d3935f2baf1686b1618df11548f1ea7478d8ede88edb60

Download Submit
C:\Users\Admin\AppData\Roaming\dbcd.exe
Filesize
300.0MB

MD5
707a86802d4275cda27b6e989b691e0a

SHA1
5eb007b7e7f3ac28363329904493e443a15cdabf

SHA256
0a8e413babd867a1bdbbdba1e7c56643c9e13d5d26a6d803c7846f2af201936c

SHA512
511a407bedd29e7b69d03a031d16a1f0d46e2ce789065bfc427ef296e3c090d2cf2d5d1757533b5c70d3935f2baf1686b1618df11548f1ea7478d8ede88edb60

Download Submit
C:\Users\Admin\AppData\Roaming\dbcd.exe
Filesize
300.0MB

MD5
707a86802d4275cda27b6e989b691e0a

SHA1
5eb007b7e7f3ac28363329904493e443a15cdabf

SHA256
0a8e413babd867a1bdbbdba1e7c56643c9e13d5d26a6d803c7846f2af201936c

SHA512
511a407bedd29e7b69d03a031d16a1f0d46e2ce789065bfc427ef296e3c090d2cf2d5d1757533b5c70d3935f2baf1686b1618df11548f1ea7478d8ede88edb60

Download Submit
memory/60-805-0x0000000000000000-mapping.dmp

Download
memory/200-384-0x000000000040C78E-mapping.dmp

Download
memory/228-916-0x0000000000000000-mapping.dmp

Download
memory/348-660-0x0000000000000000-mapping.dmp

Download
memory/440-652-0x0000000000000000-mapping.dmp

Download
memory/652-739-0x0000000000000000-mapping.dmp

Download
memory/708-880-0x0000000000000000-mapping.dmp

Download
memory/1044-743-0x0000000000000000-mapping.dmp

Download
memory/1092-803-0x0000000000000000-mapping.dmp

Download
memory/1316-876-0x0000000000000000-mapping.dmp

Download
memory/1432-649-0x0000000000000000-mapping.dmp

Download
memory/1484-143-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-139-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-145-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-146-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-147-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-148-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-149-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-150-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-151-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-152-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-153-0x0000000000210000-0x0000000000238000-memory.dmp

Filesize
160KB

Download
memory/1484-154-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-155-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-156-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-157-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-158-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-159-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-160-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-161-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-162-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-163-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-164-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-165-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-166-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-121-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-122-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-123-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-172-0x00000000051E0000-0x00000000056DE000-memory.dmp

Filesize
5.0MB

Download
memory/1484-124-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-125-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-127-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-142-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-141-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-140-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-138-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-144-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-137-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-136-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-126-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-128-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-135-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-129-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-133-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-130-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-131-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-134-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-132-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1484-120-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1596-654-0x0000000000000000-mapping.dmp

Download
memory/1604-659-0x0000000000000000-mapping.dmp

Download
memory/1656-168-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1656-173-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1656-167-0x0000000000000000-mapping.dmp

Download
memory/1656-169-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1656-171-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1656-170-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/1692-758-0x0000000000000000-mapping.dmp

Download
memory/1752-657-0x0000000000000000-mapping.dmp

Download
memory/1764-656-0x0000000000000000-mapping.dmp

Download
memory/1848-903-0x0000000000000000-mapping.dmp

Download
memory/1856-920-0x0000000000000000-mapping.dmp

Download
memory/1872-364-0x0000000000000000-mapping.dmp

Download
memory/1940-881-0x0000000000000000-mapping.dmp

Download
memory/1944-847-0x0000000000000000-mapping.dmp

Download
memory/2164-837-0x0000000000000000-mapping.dmp

Download
memory/2192-352-0x0000000000000000-mapping.dmp

Download
memory/2212-650-0x0000000000000000-mapping.dmp

Download
memory/2264-651-0x0000000000000000-mapping.dmp

Download
memory/2352-746-0x0000000000000000-mapping.dmp

Download
memory/2408-658-0x0000000000000000-mapping.dmp

Download
memory/2412-767-0x0000000000000000-mapping.dmp

Download
memory/2612-777-0x0000000000000000-mapping.dmp

Download
memory/2716-655-0x0000000000000000-mapping.dmp

Download
memory/2768-357-0x0000000000000000-mapping.dmp

Download
memory/2836-661-0x0000000000000000-mapping.dmp

Download
memory/2916-663-0x0000000000000000-mapping.dmp

Download
memory/2940-662-0x0000000000000000-mapping.dmp

Download
memory/3180-789-0x0000000000000000-mapping.dmp

Download
memory/3516-902-0x0000000000000000-mapping.dmp

Download
memory/3580-775-0x0000000000000000-mapping.dmp

Download
memory/3792-867-0x0000000000000000-mapping.dmp

Download
memory/3812-653-0x0000000000000000-mapping.dmp

Download
memory/3824-921-0x0000000000000000-mapping.dmp

Download
memory/3884-498-0x0000000000000000-mapping.dmp

Download
memory/3968-778-0x0000000000000000-mapping.dmp

Download
memory/4072-877-0x0000000000000000-mapping.dmp

Download
memory/4168-832-0x0000000000000000-mapping.dmp

Download
memory/4220-909-0x0000000000000000-mapping.dmp

Download
memory/4272-735-0x0000000000000000-mapping.dmp

Download
memory/4352-728-0x0000000000000000-mapping.dmp

Download
memory/4352-497-0x0000000000000000-mapping.dmp

Download
memory/4456-854-0x0000000000000000-mapping.dmp

Download
memory/4512-747-0x0000000000000000-mapping.dmp

Download
memory/4552-491-0x0000000000000000-mapping.dmp

Download
memory/4580-178-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4580-176-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4580-177-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4580-175-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4580-174-0x0000000000000000-mapping.dmp

Download
memory/4580-184-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4620-729-0x0000000000000000-mapping.dmp

Download
memory/4668-782-0x0000000000000000-mapping.dmp

Download
memory/4676-908-0x0000000000000000-mapping.dmp

Download
memory/4840-776-0x0000000000000000-mapping.dmp

Download
memory/4856-179-0x0000000000000000-mapping.dmp

Download
memory/4856-182-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4856-183-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4856-181-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4856-185-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4856-180-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4856-188-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4856-187-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4856-186-0x0000000077850000-0x00000000779DE000-memory.dmp

Filesize
1.6MB

Download
memory/4884-524-0x000000000040C78E-mapping.dmp

Download
memory/4896-918-0x0000000000000000-mapping.dmp

Download
memory/4992-840-0x0000000000000000-mapping.dmp

Download
memory/5052-679-0x0000000008070000-0x0000000008092000-memory.dmp

Filesize
136KB

Download
memory/5052-738-0x0000000008550000-0x0000000008572000-memory.dmp

Filesize
136KB

Download
memory/5052-208-0x000000000040C78E-mapping.dmp

Download
memory/5052-640-0x0000000007BA0000-0x0000000007BC2000-memory.dmp

Filesize
136KB

Download
memory/5052-885-0x0000000007CB0000-0x0000000007CD2000-memory.dmp

Filesize
136KB

Download
memory/5052-895-0x0000000007E90000-0x0000000007EB2000-memory.dmp

Filesize
136KB

Download
memory/5052-879-0x0000000002B40000-0x0000000002B62000-memory.dmp

Filesize
136KB

Download
memory/5052-796-0x0000000008170000-0x0000000008192000-memory.dmp

Filesize
136KB

Download
memory/5052-257-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5052-883-0x00000000078B0000-0x00000000078D2000-memory.dmp

Filesize
136KB

Download
memory/5052-292-0x0000000005930000-0x00000000059CC000-memory.dmp

Filesize
624KB

Download
memory/5052-293-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Filesize
408KB

Download
memory/5052-931-0x0000000008590000-0x00000000085B2000-memory.dmp

Filesize
136KB

Download
memory/5052-826-0x0000000007AF0000-0x0000000007B12000-memory.dmp

Filesize
136KB

Download
memory/5052-730-0x0000000007FC0000-0x0000000007FE2000-memory.dmp

Filesize
136KB

Download
memory/5052-637-0x00000000075D0000-0x00000000075F2000-memory.dmp

Filesize
136KB

Download
memory/5052-670-0x00000000079A0000-0x00000000079C2000-memory.dmp

Filesize
136KB

Download
memory/5052-642-0x0000000008EB0000-0x0000000008ED2000-memory.dmp

Filesize
136KB

Download
memory/5052-631-0x0000000006BF0000-0x0000000006C66000-memory.dmp

Filesize
472KB

Download
memory/5052-634-0x0000000006210000-0x0000000006232000-memory.dmp

Filesize
136KB

Download
memory/5052-946-0x0000000007DB0000-0x0000000007DD2000-memory.dmp

Filesize
136KB

Download
memory/5052-664-0x0000000007A10000-0x0000000007A32000-memory.dmp

Filesize
136KB

Download
memory/5052-675-0x0000000007E00000-0x0000000007E22000-memory.dmp

Filesize
136KB

Download
memory/5052-635-0x0000000006E70000-0x0000000006E92000-memory.dmp

Filesize
136KB

Download
memory/5052-636-0x00000000075F0000-0x000000000760E000-memory.dmp

Filesize
120KB

Download
memory/5064-800-0x0000000000000000-mapping.dmp

Download
memory/5084-919-0x0000000000000000-mapping.dmp

Download