Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    242s
  • max time network
    298s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/04/2024, 23:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e7ffc939703ae9bc25dba409c100173df1c2568a1e50d9731b68e5365e6dea5e.exe
  • Size 1.8MB
  • Sample240404-21f93ach2z
  • SHA256 e7ffc939703ae9bc25dba409c100173df1c2568a1e50d9731b68e5365e6dea5e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeygluptebalummaredlineriseprozgrat@oleh_pspjok123livetrafficgooglediscoverydropperevasioninfostealerloaderpersistencephishingratrootkitspywarestealerthemidatrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 4.17

C2

  • http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • @OLEH_PSP

C2

  • 185.172.128.33:8970

Extracted

Family

  • redline

Botnet

  • Jok123

C2

  • 185.215.113.67:26260

Extracted

Family

  • redline

Botnet

  • LiveTraffic

C2

  • 4.185.137.132:1632

Extracted

Family

  • lumma

C2

  • https://affordcharmcropwo.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 6 IoCs
  • Detected google phishing page
    phishinggoogle
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 1 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 9 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 9 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    evasion
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 42 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 15 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 14 IoCs
    persistence
  • Themida packer 9 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Windows security modification 2 TTPs 9 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 27 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 24 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 3 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 31 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e7ffc939703ae9bc25dba409c100173df1c2568a1e50d9731b68e5365e6dea5e.exe
    "C:\Users\Admin\AppData\Local\Temp\e7ffc939703ae9bc25dba409c100173df1c2568a1e50d9731b68e5365e6dea5e.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:588
  • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4744
    • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
      "C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1324
        • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
          "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
          4⤵
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2328
        • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
          "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4808
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
          4⤵
            PID:7140
            • C:\Windows\SysWOW64\choice.exe
              choice /C Y /N /D Y /T 3
              5⤵
                PID:5364
        • C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
          "C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"
          2⤵
          • Executes dropped EXE
          PID:4536
        • C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
          "C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4256
        • C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
          "C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:912
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:3064
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:504
          • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
            "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3872
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F
              3⤵
              • Creates scheduled task(s)
              PID:4868
            • C:\Users\Admin\AppData\Local\Temp\1000180001\ISetup8.exe
              "C:\Users\Admin\AppData\Local\Temp\1000180001\ISetup8.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:784
              • C:\Users\Admin\AppData\Local\Temp\1000180001\ISetup8.exe
                "C:\Users\Admin\AppData\Local\Temp\1000180001\ISetup8.exe"
                4⤵
                • Executes dropped EXE
                PID:292
            • C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe
              "C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4696
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:7164
              • C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe
                "C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"
                4⤵
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Adds Run key to start application
                • Checks for VirtualBox DLLs, possible anti-VM trick
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                PID:1900
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:6552
                • C:\Windows\System32\cmd.exe
                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                  5⤵
                    PID:6748
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      • Modifies data under HKEY_USERS
                      PID:5364
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious use of AdjustPrivilegeToken
                    PID:6548
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious use of AdjustPrivilegeToken
                    PID:6216
                  • C:\Windows\rss\csrss.exe
                    C:\Windows\rss\csrss.exe
                    5⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Manipulates WinMonFS driver.
                    • Drops file in Windows directory
                    PID:2784
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      PID:6560
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      6⤵
                      • Creates scheduled task(s)
                      PID:6252
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /delete /tn ScheduledUpdate /f
                      6⤵
                        PID:3024
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:1820
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:6412
                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                        6⤵
                        • Executes dropped EXE
                        PID:6200
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        6⤵
                        • Creates scheduled task(s)
                        PID:6932
                      • C:\Windows\windefender.exe
                        "C:\Windows\windefender.exe"
                        6⤵
                        • Executes dropped EXE
                        PID:1388
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                          7⤵
                            PID:2124
                            • C:\Windows\SysWOW64\sc.exe
                              sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                              8⤵
                              • Launches sc.exe
                              PID:3620
                  • C:\Users\Admin\AppData\Local\Temp\1000184001\toolspub1.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000184001\toolspub1.exe"
                    3⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    PID:4624
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 488
                      4⤵
                      • Program crash
                      PID:2332
                • C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe
                  "C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:4596
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    3⤵
                      PID:4024
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:372
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 824
                      3⤵
                      • Program crash
                      PID:1032
                  • C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe
                    "C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:1768
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 784
                      3⤵
                      • Program crash
                      PID:4364
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      3⤵
                        PID:4556
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                      2⤵
                      • Loads dropped DLL
                      PID:4036
                      • C:\Windows\system32\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                        3⤵
                        • Blocklisted process makes network request
                        • Loads dropped DLL
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1828
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profiles
                          4⤵
                            PID:1300
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\699363923187_Desktop.zip' -CompressionLevel Optimal
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4816
                      • C:\Users\Admin\AppData\Local\Temp\1001082001\go.exe
                        "C:\Users\Admin\AppData\Local\Temp\1001082001\go.exe"
                        2⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:4508
                      • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                        "C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"
                        2⤵
                          PID:4788
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                          2⤵
                          • Blocklisted process makes network request
                          • Loads dropped DLL
                          PID:5452
                        • C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe
                          "C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe"
                          2⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          PID:5856
                        • C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe
                          "C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe"
                          2⤵
                          • UAC bypass
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • System policy modification
                          PID:380
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe" -Force
                            3⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4472
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                            3⤵
                              PID:1056
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4780
                              • C:\Users\Admin\Pictures\agauGRZH0UPqqiyfU4FzhRhe.exe
                                "C:\Users\Admin\Pictures\agauGRZH0UPqqiyfU4FzhRhe.exe"
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:5380
                                • C:\Users\Admin\Pictures\agauGRZH0UPqqiyfU4FzhRhe.exe
                                  "C:\Users\Admin\Pictures\agauGRZH0UPqqiyfU4FzhRhe.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  PID:5604
                              • C:\Users\Admin\Pictures\ll3T4bdNEvY3HXyM6JPc8JLv.exe
                                "C:\Users\Admin\Pictures\ll3T4bdNEvY3HXyM6JPc8JLv.exe"
                                4⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5756
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5868
                                • C:\Users\Admin\Pictures\ll3T4bdNEvY3HXyM6JPc8JLv.exe
                                  "C:\Users\Admin\Pictures\ll3T4bdNEvY3HXyM6JPc8JLv.exe"
                                  5⤵
                                  • Windows security bypass
                                  • Executes dropped EXE
                                  • Windows security modification
                                  • Adds Run key to start application
                                  • Checks for VirtualBox DLLs, possible anti-VM trick
                                  • Drops file in Windows directory
                                  PID:792
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -nologo -noprofile
                                    6⤵
                                    • Drops file in System32 directory
                                    • Modifies data under HKEY_USERS
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:6580
                                  • C:\Windows\System32\cmd.exe
                                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                    6⤵
                                      PID:5108
                                      • C:\Windows\system32\netsh.exe
                                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                        7⤵
                                        • Modifies Windows Firewall
                                        PID:3116
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -nologo -noprofile
                                      6⤵
                                      • Drops file in System32 directory
                                      • Modifies data under HKEY_USERS
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:7140
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -nologo -noprofile
                                      6⤵
                                      • Drops file in System32 directory
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6732
                                • C:\Users\Admin\Pictures\5r9eEp9zt7CCm06S8IA8FTbm.exe
                                  "C:\Users\Admin\Pictures\5r9eEp9zt7CCm06S8IA8FTbm.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5112
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -nologo -noprofile
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:6228
                                  • C:\Users\Admin\Pictures\5r9eEp9zt7CCm06S8IA8FTbm.exe
                                    "C:\Users\Admin\Pictures\5r9eEp9zt7CCm06S8IA8FTbm.exe"
                                    5⤵
                                    • Windows security bypass
                                    • Executes dropped EXE
                                    • Windows security modification
                                    • Adds Run key to start application
                                    • Checks for VirtualBox DLLs, possible anti-VM trick
                                    • Drops file in Windows directory
                                    PID:6408
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -nologo -noprofile
                                      6⤵
                                      • Drops file in System32 directory
                                      • Modifies data under HKEY_USERS
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6676
                                    • C:\Windows\System32\cmd.exe
                                      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                      6⤵
                                        PID:5040
                                        • C:\Windows\system32\netsh.exe
                                          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                          7⤵
                                          • Modifies Windows Firewall
                                          PID:5788
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -nologo -noprofile
                                        6⤵
                                        • Drops file in System32 directory
                                        • Modifies data under HKEY_USERS
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4208
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -nologo -noprofile
                                        6⤵
                                        • Drops file in System32 directory
                                        • Modifies data under HKEY_USERS
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5420
                                  • C:\Users\Admin\Pictures\uQzqITxwGvepT3zDBjWSUFxy.exe
                                    "C:\Users\Admin\Pictures\uQzqITxwGvepT3zDBjWSUFxy.exe" --silent --allusers=0
                                    4⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Enumerates connected drives
                                    • Modifies system certificate store
                                    PID:6324
                                    • C:\Users\Admin\Pictures\uQzqITxwGvepT3zDBjWSUFxy.exe
                                      C:\Users\Admin\Pictures\uQzqITxwGvepT3zDBjWSUFxy.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2a4,0x2a8,0x2ac,0x2a0,0x2b0,0x6b33e1d0,0x6b33e1dc,0x6b33e1e8
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:6484
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\uQzqITxwGvepT3zDBjWSUFxy.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\uQzqITxwGvepT3zDBjWSUFxy.exe" --version
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:6672
                                    • C:\Users\Admin\Pictures\uQzqITxwGvepT3zDBjWSUFxy.exe
                                      "C:\Users\Admin\Pictures\uQzqITxwGvepT3zDBjWSUFxy.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=6324 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240404230338" --session-guid=90966e02-6f78-4c07-8f10-db45093d357d --server-tracking-blob=YTYxNTE2YTJlODZjZjFkYWYyZGJmYzY0ZDVkZjRjMWI0Zjc5OWE5MDk0OTc2MWJkOWEzNjAwM2VhMDdkZDFiYjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N180NTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTIyNzE4MTIuNTMyMSIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N180NTYiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6IjE1ZGY5OWU1LWVmNzItNGY5Ny1iZDhjLWNmN2IzMTc4ZjgwZiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=4C04000000000000
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Enumerates connected drives
                                      PID:6832
                                      • C:\Users\Admin\Pictures\uQzqITxwGvepT3zDBjWSUFxy.exe
                                        C:\Users\Admin\Pictures\uQzqITxwGvepT3zDBjWSUFxy.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2a0,0x2b0,0x2b4,0x27c,0x2b8,0x6a9be1d0,0x6a9be1dc,0x6a9be1e8
                                        6⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:6948
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042303381\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042303381\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      PID:6796
                                    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042303381\assistant\assistant_installer.exe
                                      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042303381\assistant\assistant_installer.exe" --version
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:3808
                                      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042303381\assistant\assistant_installer.exe
                                        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042303381\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0xfd0040,0xfd004c,0xfd0058
                                        6⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:7016
                                  • C:\Users\Admin\Pictures\GasP3n9DmP8KjL2pQQoQEkWv.exe
                                    "C:\Users\Admin\Pictures\GasP3n9DmP8KjL2pQQoQEkWv.exe"
                                    4⤵
                                    • Modifies firewall policy service
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Drops file in System32 directory
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    PID:6856
                                  • C:\Users\Admin\Pictures\fyOVVB6pxYXJrxMjvecoPj3N.exe
                                    "C:\Users\Admin\Pictures\fyOVVB6pxYXJrxMjvecoPj3N.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    PID:6304
                                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
                                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
                                      5⤵
                                      • Executes dropped EXE
                                      PID:6400
                                      • C:\Windows\SYSTEM32\msiexec.exe
                                        "msiexec.exe" /qn /i VirtualBox-6.1.20-r143896.msi ADDLOCAL=VBoxApplication,VBoxPython VBOX_INSTALLDESKTOPSHORTCUT=0 VBOX_INSTALLQUICKLAUNCHSHORTCUT=0 /log "C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt"
                                        6⤵
                                          PID:6140
                                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce_7.14.2_windows_x86_64.exe
                                          "ce_7.14.2_windows_x86_64.exe" /S /v"/qn ACCTMGR_LOGIN=anonymous ACCTMGR_PASSWORDHASH=S16-01 /norestart /log C:\Users\Admin\AppData\Local\Temp\charityengine-install-ce-log.txt"
                                          6⤵
                                            PID:6868
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                  1⤵
                                  • Drops file in Windows directory
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3236
                                • C:\Windows\system32\browser_broker.exe
                                  C:\Windows\system32\browser_broker.exe -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  PID:3216
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                  1⤵
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3920
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                  1⤵
                                  • Drops file in Windows directory
                                  • Modifies Internet Explorer settings
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5176
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                  1⤵
                                  • Drops file in Windows directory
                                  PID:5284
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                  1⤵
                                  • Drops file in Windows directory
                                  PID:5384
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                  1⤵
                                  • Drops file in Windows directory
                                  PID:5556
                                • C:\Windows\system32\browser_broker.exe
                                  C:\Windows\system32\browser_broker.exe -Embedding
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  PID:6060
                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                  1⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:6028
                                • \??\c:\windows\system32\svchost.exe
                                  c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                  1⤵
                                    PID:6700
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                    1⤵
                                      PID:2900
                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                      1⤵
                                      • Drops file in Windows directory
                                      PID:3256
                                    • C:\Windows\system32\browser_broker.exe
                                      C:\Windows\system32\browser_broker.exe -Embedding
                                      1⤵
                                        PID:6420
                                      • C:\Windows\system32\browser_broker.exe
                                        C:\Windows\system32\browser_broker.exe -Embedding
                                        1⤵
                                        • Modifies Internet Explorer settings
                                        PID:6672
                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                        1⤵
                                        • Drops file in Windows directory
                                        PID:6728
                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                        1⤵
                                        • Drops file in Windows directory
                                        PID:3692
                                      • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                        C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                        1⤵
                                        • Executes dropped EXE
                                        PID:2784
                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                        1⤵
                                        • Drops file in Windows directory
                                        PID:6996
                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                        1⤵
                                          PID:1764
                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                          1⤵
                                          • Modifies registry class
                                          PID:6592
                                        • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                          C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                          1⤵
                                          • Executes dropped EXE
                                          PID:6492
                                        • C:\Windows\windefender.exe
                                          C:\Windows\windefender.exe
                                          1⤵
                                          • Executes dropped EXE
                                          • Modifies data under HKEY_USERS
                                          PID:3644
                                        • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                          C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                          1⤵
                                          • Executes dropped EXE
                                          PID:2156
                                        • C:\Windows\system32\msiexec.exe
                                          C:\Windows\system32\msiexec.exe /V
                                          1⤵
                                          • Blocklisted process makes network request
                                          • Registers COM server for autorun
                                          • Enumerates connected drives
                                          • Drops file in Program Files directory
                                          • Drops file in Windows directory
                                          • Modifies registry class
                                          PID:6180
                                          • C:\Windows\System32\MsiExec.exe
                                            C:\Windows\System32\MsiExec.exe -Embedding 9B7B5C4BCECFA3620794999271002B57
                                            2⤵
                                            • Loads dropped DLL
                                            PID:7088
                                          • C:\Windows\System32\MsiExec.exe
                                            C:\Windows\System32\MsiExec.exe -Embedding F6633799DB793F10CB8EAC340694C728 E Global\MSI0000
                                            2⤵
                                            • Drops file in Drivers directory
                                            • Loads dropped DLL
                                            • Drops file in System32 directory
                                            • Modifies data under HKEY_USERS
                                            PID:6852
                                          • C:\Windows\syswow64\MsiExec.exe
                                            C:\Windows\syswow64\MsiExec.exe -Embedding F3B9BBBC0F52A005225C9AA516E86389 M Global\MSI0000
                                            2⤵
                                            • Modifies registry class
                                            PID:5596
                                        • C:\Windows\system32\LogonUI.exe
                                          "LogonUI.exe" /flags:0x0 /state0:0xa3aa4855 /state1:0x41c64e6d
                                          1⤵
                                            PID:5040

                                          Network

                                                MITRE ATT&CK Enterprise v15

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Persistence

                                                Boot or Logon Autostart Execution

                                                2
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                2
                                                T1547.001

                                                Create or Modify System Process

                                                2
                                                T1543

                                                Windows Service

                                                2
                                                T1543.003

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Privilege Escalation

                                                Abuse Elevation Control Mechanism

                                                1
                                                T1548

                                                Bypass User Account Control

                                                1
                                                T1548.002

                                                Boot or Logon Autostart Execution

                                                2
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                2
                                                T1547.001

                                                Create or Modify System Process

                                                2
                                                T1543

                                                Windows Service

                                                2
                                                T1543.003

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Defense Evasion

                                                Abuse Elevation Control Mechanism

                                                1
                                                T1548

                                                Bypass User Account Control

                                                1
                                                T1548.002

                                                Impair Defenses

                                                4
                                                T1562

                                                Disable or Modify System Firewall

                                                1
                                                T1562.004

                                                Disable or Modify Tools

                                                3
                                                T1562.001

                                                Modify Registry

                                                8
                                                T1112

                                                Subvert Trust Controls

                                                1
                                                T1553

                                                Install Root Certificate

                                                1
                                                T1553.004

                                                Virtualization/Sandbox Evasion

                                                2
                                                T1497

                                                Credential Access

                                                Unsecured Credentials

                                                5
                                                T1552

                                                Credentials In Files

                                                4
                                                T1552.001

                                                Credentials in Registry

                                                1
                                                T1552.002

                                                Discovery

                                                Peripheral Device Discovery

                                                2
                                                T1120

                                                Query Registry

                                                8
                                                T1012

                                                System Information Discovery

                                                7
                                                T1082

                                                Virtualization/Sandbox Evasion

                                                2
                                                T1497

                                                Lateral Movement

                                                Collection

                                                Data from Local System

                                                5
                                                T1005

                                                Command and Control

                                                Web Service

                                                1
                                                T1102

                                                Exfiltration

                                                Impact

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                e5b04a3.rbs
                                                • Path C:\Config.Msi\e5b04a3.rbs
                                                • Size 894KB
                                                • SHA256 e948b60ca8fbb5534ad4cfdd9011482a5fded321e329d99e9e97db4f0390f9c6
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                edgecompatviewlist[1].xml
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WFQ509M6\edgecompatviewlist[1].xml
                                                • Size 74KB
                                                • SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                StartupProfileData-NonInteractive
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                • Size 1KB
                                                • SHA256 0378938bf0c06f4d7846a6caf97fa52885f245c509a020655d246c4f684ed06b
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                suggestions[1].en-US
                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\K8171U3A\suggestions[1].en-US
                                                • Size 17KB
                                                • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                4Kv5U5b1o3f[1].png
                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\NH5NLFXP\4Kv5U5b1o3f[1].png
                                                • Size 610B
                                                • SHA256 2bc7a47889c56ad49f1b8b97385d5a4d212e79bb8a9b30df0665a165f58b273e
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                favicon[1].ico
                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\YXBJYZL4\favicon[1].ico
                                                • Size 5KB
                                                • SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                GJ7K2ROF.cookie
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\GJ7K2ROF.cookie
                                                • Size 314B
                                                • SHA256 f7982a4ca03b54ba3bc9ed469522145e4a1595feaa77119250762a60f51efbb5
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                • Size 1KB
                                                • SHA256 64d459714f98144b7a04079efbd965519d8b0bd3ed0021832e3683e79bcd41c6
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                • Size 724B
                                                • SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                • Size 410B
                                                • SHA256 4d42791f4fd89f600cd19bf0d0cada8375b3c7b5ac19759ee8703de9a5ae1fe7
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                • Size 392B
                                                • SHA256 247563012c7fda12071b779ccb7ee5b038365208de1d1e07489450a032628438
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                additional_file0.tmp
                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042303381\additional_file0.tmp
                                                • Size 2.5MB
                                                • SHA256 fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                opera_package
                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404042303381\opera_package
                                                • Size 103.9MB
                                                • SHA256 473f0d4b886db8cd39b900b92bdc0625a3fcec8addd43f71179696bdf186ec3b
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                explorgu.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                                                • Size 1.8MB
                                                • SHA256 e7ffc939703ae9bc25dba409c100173df1c2568a1e50d9731b68e5365e6dea5e
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                ISetup8.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000180001\ISetup8.exe
                                                • Size 344KB
                                                • SHA256 a6ce6890aa019d53389c89e591e61bbb7b2e8703a63e4f2ef7b178b3e630669e
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                4767d2e713f2021e8fe856e3ea638b58.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe
                                                • Size 4.1MB
                                                • SHA256 8a2289028089e0cc4b6f045b77367c591b39cba31aabed69834e046b6bee3432
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                toolspub1.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000184001\toolspub1.exe
                                                • Size 173KB
                                                • SHA256 5abc09e0d482ca302a3b5523aa8f0d446acbc3a1523e6b17dcb689e30be68915
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                alex1234.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
                                                • Size 1.7MB
                                                • SHA256 3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                redlinepanel.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
                                                • Size 301KB
                                                • SHA256 2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                32456.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
                                                • Size 499KB
                                                • SHA256 09cc3364d5e1c15228822926bc65ce290c487dc3b7c0345bf265538110fa9cc9
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                goldprimeldlldf.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
                                                • Size 464KB
                                                • SHA256 afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                NewB.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                                • Size 418KB
                                                • SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                swiiiii.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe
                                                • Size 321KB
                                                • SHA256 e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                koooooo.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe
                                                • Size 379KB
                                                • SHA256 23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                go.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1001082001\go.exe
                                                • Size 894KB
                                                • SHA256 59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                random.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe
                                                • Size 3.0MB
                                                • SHA256 c3425f0e26bf725ca7b79b15e5967c5c27d6792fe6df4dc26a98e13ffd84d01f
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                file300un.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe
                                                • Size 400KB
                                                • SHA256 0a9df33580d2f032589301602ae78df0fd0daa276eb5308695e5978626996ff7
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                TmpB9F9.tmp
                                                • Path C:\Users\Admin\AppData\Local\Temp\TmpB9F9.tmp
                                                • Size 2KB
                                                • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                __PSScriptPolicyTest_egu1n31a.jg0.ps1
                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_egu1n31a.jg0.ps1
                                                • Size 1B
                                                • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                clip64.dll
                                                • Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                                                • Size 109KB
                                                • SHA256 8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                cred64.dll
                                                • Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
                                                • Size 1.2MB
                                                • SHA256 b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                Traffic.exe
                                                • Path C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                                                • Size 541KB
                                                • SHA256 f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                propro.exe
                                                • Path C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                                                • Size 304KB
                                                • SHA256 bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                CypCLagKAEP5ab88F6dMTmDT.exe
                                                • Path C:\Users\Admin\Pictures\CypCLagKAEP5ab88F6dMTmDT.exe
                                                • Size 3KB
                                                • SHA256 1915ebb4fb26930663efee6d03106d9d6ebe370cbc9f4d5e38e363cf10b40c17
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                GasP3n9DmP8KjL2pQQoQEkWv.exe
                                                • Path C:\Users\Admin\Pictures\GasP3n9DmP8KjL2pQQoQEkWv.exe
                                                • Size 4.3MB
                                                • SHA256 d97a7fc44bf341b9b2b2e65b46dab4f7d329afe15b4308b5aa56d5bfd7b99d35
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                UA67oXa6Rjw4nu71SBdgsVMN.exe
                                                • Path C:\Users\Admin\Pictures\UA67oXa6Rjw4nu71SBdgsVMN.exe
                                                • Size 7KB
                                                • SHA256 e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                X4Ahz3Owd5kv3SFgwMtJMqgs.exe
                                                • Path C:\Users\Admin\Pictures\X4Ahz3Owd5kv3SFgwMtJMqgs.exe
                                                • Size 3KB
                                                • SHA256 49f4598f05cd5121500b9bbf777b77f6a6da5a252132fa1683b5dd3b342bf86e
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                agauGRZH0UPqqiyfU4FzhRhe.exe
                                                • Path C:\Users\Admin\Pictures\agauGRZH0UPqqiyfU4FzhRhe.exe
                                                • Size 344KB
                                                • SHA256 b8d261c3ad8dc7079256bcb9236657b733950c2618472ec47fb54309f9df9faf
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                ll3T4bdNEvY3HXyM6JPc8JLv.exe
                                                • Path C:\Users\Admin\Pictures\ll3T4bdNEvY3HXyM6JPc8JLv.exe
                                                • Size 4.1MB
                                                • SHA256 7e3d844edd6d0a788ab1c9f1ea88ca2cb04809ee21aa55f0c2265a927507b187
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                uQzqITxwGvepT3zDBjWSUFxy.exe
                                                • Path C:\Users\Admin\Pictures\uQzqITxwGvepT3zDBjWSUFxy.exe
                                                • Size 5.1MB
                                                • SHA256 8c4e97a094387582d9bc3ee1ef2d38cbbc47482136ad26c80c32ab64cf53a767
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                Google Chrome.lnk
                                                • Path C:\Users\Public\Desktop\Google Chrome.lnk
                                                • Size 2KB
                                                • SHA256 5dfcc41af9821d7d22151155f04904fce08c103200f6acc165e5debb33489de4
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                MSI1DFA.tmp
                                                • Path C:\Windows\Installer\MSI1DFA.tmp
                                                • Size 195KB
                                                • SHA256 cedff33eba97e81df4248a087441b1cd9877fa63aded5d357f601302ae6d9cf8
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                e5b04a0.msi
                                                • Path C:\Windows\Installer\e5b04a0.msi
                                                • Size 34.7MB
                                                • SHA256 098300852dabb3ed345e1874724c373dc1f9bf249ca453a972b2cbc696103d76
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                VBoxDrv.sys
                                                • Path C:\Windows\System32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.sys
                                                • Size 1013KB
                                                • SHA256 05045c57480d3d5996e10a60393e799647c4ddaf6ede5f712d520c2a2841d43b
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                gpt.ini
                                                • Path C:\Windows\System32\GroupPolicy\gpt.ini
                                                • Size 127B
                                                • SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                Opera_installer_2404042303373816324.dll
                                                • Path \Users\Admin\AppData\Local\Temp\Opera_installer_2404042303373816324.dll
                                                • Size 4.6MB
                                                • SHA256 668bf8a7f3e53953dd6789fc6146a205c6c7330832c5d20b439eedb7c52ed303
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                memory/292-201-0x0000000000400000-0x000000000046E000-memory.dmp
                                                Download

                                                memory/292-198-0x0000000000400000-0x000000000046E000-memory.dmp
                                                Download

                                                memory/292-203-0x0000000000400000-0x000000000046E000-memory.dmp
                                                Download

                                                memory/372-216-0x0000000000400000-0x000000000044C000-memory.dmp
                                                Download

                                                memory/372-212-0x0000000000400000-0x000000000044C000-memory.dmp
                                                Download

                                                memory/504-152-0x0000000072E90000-0x000000007357E000-memory.dmp
                                                Download

                                                memory/504-146-0x0000000000400000-0x0000000000450000-memory.dmp
                                                Download

                                                memory/588-10-0x0000000005560000-0x0000000005561000-memory.dmp
                                                Download

                                                memory/588-6-0x0000000005540000-0x0000000005541000-memory.dmp
                                                Download

                                                memory/588-14-0x0000000000B90000-0x000000000105B000-memory.dmp
                                                Download

                                                memory/588-0-0x0000000000B90000-0x000000000105B000-memory.dmp
                                                Download

                                                memory/588-3-0x0000000005510000-0x0000000005511000-memory.dmp
                                                Download

                                                memory/588-4-0x0000000005520000-0x0000000005521000-memory.dmp
                                                Download

                                                memory/588-5-0x0000000005500000-0x0000000005501000-memory.dmp
                                                Download

                                                memory/588-1-0x0000000077C44000-0x0000000077C45000-memory.dmp
                                                Download

                                                memory/588-2-0x0000000000B90000-0x000000000105B000-memory.dmp
                                                Download

                                                memory/588-8-0x00000000054F0000-0x00000000054F1000-memory.dmp
                                                Download

                                                memory/588-7-0x00000000054E0000-0x00000000054E1000-memory.dmp
                                                Download

                                                memory/784-199-0x00000000047F0000-0x000000000485D000-memory.dmp
                                                Download

                                                memory/784-197-0x0000000002C80000-0x0000000002D80000-memory.dmp
                                                Download

                                                memory/912-141-0x00000000000C0000-0x000000000013A000-memory.dmp
                                                Download

                                                memory/912-145-0x0000000004960000-0x0000000004970000-memory.dmp
                                                Download

                                                memory/912-142-0x0000000072E90000-0x000000007357E000-memory.dmp
                                                Download

                                                memory/912-151-0x0000000002240000-0x0000000004240000-memory.dmp
                                                Download

                                                memory/912-150-0x0000000072E90000-0x000000007357E000-memory.dmp
                                                Download

                                                memory/1324-45-0x0000000000400000-0x0000000000592000-memory.dmp
                                                Download

                                                memory/1324-153-0x0000000072E90000-0x000000007357E000-memory.dmp
                                                Download

                                                memory/1324-52-0x0000000072E90000-0x000000007357E000-memory.dmp
                                                Download

                                                memory/1984-148-0x0000000002F90000-0x0000000004F90000-memory.dmp
                                                Download

                                                memory/1984-40-0x0000000000A20000-0x0000000000BDC000-memory.dmp
                                                Download

                                                memory/1984-42-0x0000000005570000-0x0000000005580000-memory.dmp
                                                Download

                                                memory/1984-41-0x0000000072E90000-0x000000007357E000-memory.dmp
                                                Download

                                                memory/1984-50-0x0000000072E90000-0x000000007357E000-memory.dmp
                                                Download

                                                memory/1984-51-0x0000000002F90000-0x0000000004F90000-memory.dmp
                                                Download

                                                memory/2328-60-0x0000000072E90000-0x000000007357E000-memory.dmp
                                                Download

                                                memory/2328-98-0x0000000004D80000-0x0000000004D90000-memory.dmp
                                                Download

                                                memory/2328-108-0x0000000005F30000-0x0000000005F4E000-memory.dmp
                                                Download

                                                memory/2328-101-0x0000000005760000-0x00000000057D6000-memory.dmp
                                                Download

                                                memory/2328-80-0x0000000004C30000-0x0000000004C3A000-memory.dmp
                                                Download

                                                memory/2328-61-0x0000000000360000-0x00000000003B2000-memory.dmp
                                                Download

                                                memory/2328-72-0x0000000004C40000-0x0000000004CD2000-memory.dmp
                                                Download

                                                memory/2328-196-0x0000000072E90000-0x000000007357E000-memory.dmp
                                                Download

                                                memory/2328-71-0x00000000050A0000-0x000000000559E000-memory.dmp
                                                Download

                                                memory/3236-336-0x0000023D12920000-0x0000023D12930000-memory.dmp
                                                Download

                                                memory/3236-355-0x0000023D16F90000-0x0000023D16F92000-memory.dmp
                                                Download

                                                memory/4256-127-0x000000001B800000-0x000000001B810000-memory.dmp
                                                Download

                                                memory/4256-125-0x00007FFE32140000-0x00007FFE32B2C000-memory.dmp
                                                Download

                                                memory/4256-126-0x0000000000AD0000-0x0000000000B52000-memory.dmp
                                                Download

                                                memory/4536-83-0x0000000000AE0000-0x0000000000B30000-memory.dmp
                                                Download

                                                memory/4536-109-0x0000000005650000-0x000000000568E000-memory.dmp
                                                Download

                                                memory/4536-111-0x00000000057D0000-0x000000000581B000-memory.dmp
                                                Download

                                                memory/4536-103-0x0000000006350000-0x0000000006956000-memory.dmp
                                                Download

                                                memory/4536-102-0x0000000072E90000-0x000000007357E000-memory.dmp
                                                Download

                                                memory/4536-104-0x00000000055A0000-0x00000000055B0000-memory.dmp
                                                Download

                                                memory/4536-105-0x00000000056C0000-0x00000000057CA000-memory.dmp
                                                Download

                                                memory/4536-107-0x00000000055F0000-0x0000000005602000-memory.dmp
                                                Download

                                                memory/4556-240-0x0000000000400000-0x000000000044C000-memory.dmp
                                                Download

                                                memory/4596-204-0x0000000000580000-0x00000000005D2000-memory.dmp
                                                Download

                                                memory/4596-205-0x0000000072E90000-0x000000007357E000-memory.dmp
                                                Download

                                                memory/4696-460-0x0000000000400000-0x0000000002F40000-memory.dmp
                                                Download

                                                memory/4744-20-0x0000000005330000-0x0000000005331000-memory.dmp
                                                Download

                                                memory/4744-21-0x0000000005360000-0x0000000005361000-memory.dmp
                                                Download

                                                memory/4744-18-0x0000000001270000-0x000000000173B000-memory.dmp
                                                Download

                                                memory/4744-19-0x0000000005340000-0x0000000005341000-memory.dmp
                                                Download

                                                memory/4744-75-0x0000000001270000-0x000000000173B000-memory.dmp
                                                Download

                                                memory/4744-195-0x0000000001270000-0x000000000173B000-memory.dmp
                                                Download

                                                memory/4744-558-0x0000000001270000-0x000000000173B000-memory.dmp
                                                Download

                                                memory/4744-106-0x0000000001270000-0x000000000173B000-memory.dmp
                                                Download

                                                memory/4744-22-0x0000000005300000-0x0000000005301000-memory.dmp
                                                Download

                                                memory/4744-23-0x0000000005320000-0x0000000005321000-memory.dmp
                                                Download

                                                memory/4744-25-0x0000000005390000-0x0000000005391000-memory.dmp
                                                Download

                                                memory/4744-26-0x0000000005380000-0x0000000005381000-memory.dmp
                                                Download

                                                memory/4744-24-0x0000000005310000-0x0000000005311000-memory.dmp
                                                Download

                                                memory/4744-381-0x0000000001270000-0x000000000173B000-memory.dmp
                                                Download

                                                memory/4744-17-0x0000000001270000-0x000000000173B000-memory.dmp
                                                Download

                                                memory/4780-552-0x0000000000400000-0x0000000000408000-memory.dmp
                                                Download

                                                memory/4808-82-0x000000001BCF0000-0x000000001BD00000-memory.dmp
                                                Download

                                                memory/4808-81-0x00007FFE32140000-0x00007FFE32B2C000-memory.dmp
                                                Download

                                                memory/4808-168-0x00007FFE32140000-0x00007FFE32B2C000-memory.dmp
                                                Download

                                                memory/4808-78-0x0000000000E80000-0x0000000000F0C000-memory.dmp
                                                Download

                                                memory/5384-705-0x000001DB72DC0000-0x000001DB72DE0000-memory.dmp
                                                Download

                                                memory/5384-673-0x000001DB73640000-0x000001DB73660000-memory.dmp
                                                Download

                                                memory/5384-657-0x000001DB739E0000-0x000001DB73AE0000-memory.dmp
                                                Download

                                                memory/5556-676-0x0000019FE7130000-0x0000019FE7132000-memory.dmp
                                                Download

                                                memory/5556-702-0x0000019FF7F60000-0x0000019FF7F62000-memory.dmp
                                                Download

                                                memory/5856-489-0x0000000000A50000-0x00000000011F8000-memory.dmp
                                                Download

                                                memory/5856-490-0x0000000000A50000-0x00000000011F8000-memory.dmp
                                                Download

                                                memory/5856-482-0x0000000000A50000-0x00000000011F8000-memory.dmp
                                                Download

                                                memory/5856-480-0x0000000000A50000-0x00000000011F8000-memory.dmp
                                                Download

                                                memory/5856-476-0x0000000000A50000-0x00000000011F8000-memory.dmp
                                                Download

                                                memory/5856-475-0x0000000000A50000-0x00000000011F8000-memory.dmp
                                                Download

                                                memory/5856-474-0x0000000000A50000-0x00000000011F8000-memory.dmp
                                                Download