4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461.exe
Size

42KB
MD5

7534978911e4c25ea1911cfa2533ff3b
SHA1

e61c511c1bd3bb92af2a5858afa7196bce09b3a6
SHA256

4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461
SHA512

178f40305d30d6e4b190f6c2bd5dca36776597ddd2e0fae48edae4421a83844dd6578a101fda133ed16faef3aee059e0d2ba46af2493a93b8930243b44739fc8
SSDEEP

768:yiYoIfHbL8KatMHv+7dwwaleRp2OuyamBlabCY787fsBANeje:XbyYt7LagG3N13oDWAN7

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 52 IoCs

resource	yara_rule
behavioral1/memory/3048-0-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/files/0x0009000000014909-5.dat	UPX
behavioral1/memory/3048-18-0x0000000003C70000-0x0000000003C8A000-memory.dmp	UPX
behavioral1/memory/2708-21-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/3048-25-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/files/0x0008000000015264-30.dat	UPX
behavioral1/memory/2708-48-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/files/0x0008000000014fe1-53.dat	UPX
behavioral1/memory/1104-70-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/2464-74-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/files/0x000a000000014909-78.dat	UPX
behavioral1/memory/1104-91-0x0000000003D70000-0x0000000003D8A000-memory.dmp	UPX
behavioral1/memory/1104-98-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/1456-93-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/files/0x0009000000015264-102.dat	UPX
behavioral1/memory/1456-121-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/1456-119-0x0000000003DB0000-0x0000000003DBB000-memory.dmp	UPX
behavioral1/memory/1820-118-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/files/0x0009000000014fe1-136.dat	UPX
behavioral1/memory/1820-139-0x0000000003940000-0x000000000395A000-memory.dmp	UPX
behavioral1/memory/1820-144-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/files/0x000b000000014909-149.dat	UPX
behavioral1/memory/2144-151-0x00000000037A0000-0x00000000037BA000-memory.dmp	UPX
behavioral1/memory/2144-170-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/1780-167-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/files/0x000a000000015264-175.dat	UPX
behavioral1/memory/1780-194-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/files/0x000a000000014fe1-201.dat	UPX
behavioral1/memory/2968-211-0x0000000003B30000-0x0000000003B4A000-memory.dmp	UPX
behavioral1/memory/2968-216-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/files/0x000c000000014909-221.dat	UPX
behavioral1/memory/2780-233-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/2944-248-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/1872-249-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/1872-266-0x0000000003DB0000-0x0000000003DBB000-memory.dmp	UPX
behavioral1/memory/1652-265-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/1872-264-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/1872-261-0x0000000003BB0000-0x0000000003BCA000-memory.dmp	UPX
behavioral1/memory/1652-283-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/2660-300-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/2072-313-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/2860-314-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/2860-329-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/2084-330-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/2084-347-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/1544-366-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/2276-364-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/2588-382-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/2276-381-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/2588-399-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/1640-397-0x0000000000400000-0x000000000041A000-memory.dmp	UPX
behavioral1/memory/2328-566-0x0000000000400000-0x000000000041A000-memory.dmp	UPX

Deletes itself 1 IoCs

pid	Process
2848	cmd.exe

Executes dropped EXE 64 IoCs

pid	Process
2708	wkihm.exe
2464	wohuqh.exe
1104	wjpnnkr.exe
1456	whyea.exe
1820	wcqbifwcm.exe
2144	wlmnffi.exe
1780	wjnql.exe
2968	wum.exe
2780	wcld.exe
2944	wbvst.exe
1872	wnnvt.exe
1652	wugqv.exe
2660	wgxswciu.exe
2072	wfgkjxvtw.exe
2860	wncwf.exe
2084	wynxrrjy.exe
1544	wkaau.exe
2276	wakxahhx.exe
2588	wti.exe
1640	wwnngwr.exe
1832	wvmt.exe
1652	wucj.exe
2028	wxwhha.exe
1880	wbpdrm.exe
1656	whiwuq.exe
2720	woqfo.exe
2100	wlypgc.exe
2276	wtrjigvne.exe
2328	wedkvaxu.exe
1616	wptanvidy.exe
2320	worfu.exe
2884	wachijmv.exe
2880	wcweswn.exe
320	wjenoy.exe
2864	wfu.exe
2696	wtxenpyky.exe
2552	wkhcrbegy.exe
876	wlcydngjd.exe
2960	wxoagsvnk.exe
2992	wirbgp.exe
2312	wxjmqceh.exe
1012	wfcfthib.exe
2792	wtmcwro.exe
2208	whmuem.exe
1556	wjuh.exe
1684	wufjvsy.exe
2040	wxnuyera.exe
1840	wqiyb.exe
2644	wxbsd.exe
2632	wtsnmni.exe
432	wiqckxeuj.exe
3064	wopxyb.exe
2968	wdpogukq.exe
528	wrymjfql.exe
792	wusjts.exe
2920	wlrlaao.exe
2820	wtgwhbs.exe
2608	wgfonvjmb.exe
1624	widsrln.exe
1592	wbmmn.exe
636	wrmalys.exe
1572	wpmds.exe
3064	wvgvu.exe
2572	wwkdoop.exe

Loads dropped DLL 64 IoCs

pid	Process
3048	4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461.exe
3048	4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461.exe
3048	4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461.exe
3048	4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461.exe
2708	wkihm.exe
2708	wkihm.exe
2708	wkihm.exe
2708	wkihm.exe
2708	wkihm.exe
2464	wohuqh.exe
2464	wohuqh.exe
2464	wohuqh.exe
2464	wohuqh.exe
2464	wohuqh.exe
1104	wjpnnkr.exe
1104	wjpnnkr.exe
1104	wjpnnkr.exe
1104	wjpnnkr.exe
1104	wjpnnkr.exe
1456	whyea.exe
1456	whyea.exe
1456	whyea.exe
1456	whyea.exe
1456	whyea.exe
1820	wcqbifwcm.exe
1820	wcqbifwcm.exe
1820	wcqbifwcm.exe
1820	wcqbifwcm.exe
1820	wcqbifwcm.exe
2144	wlmnffi.exe
2144	wlmnffi.exe
2144	wlmnffi.exe
2144	wlmnffi.exe
2144	wlmnffi.exe
1780	wjnql.exe
1780	wjnql.exe
1780	wjnql.exe
1780	wjnql.exe
1780	wjnql.exe
2968	wum.exe
2968	wum.exe
2968	wum.exe
2968	wum.exe
2968	wum.exe
2780	wcld.exe
2780	wcld.exe
2780	wcld.exe
2780	wcld.exe
2780	wcld.exe
2944	wbvst.exe
2944	wbvst.exe
2944	wbvst.exe
2944	wbvst.exe
2944	wbvst.exe
1872	wnnvt.exe
1872	wnnvt.exe
1872	wnnvt.exe
1872	wnnvt.exe
1872	wnnvt.exe
1652	wugqv.exe
1652	wugqv.exe
1652	wugqv.exe
1652	wugqv.exe
1652	wugqv.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3048-0-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/files/0x0009000000014909-5.dat	upx
behavioral1/memory/3048-18-0x0000000003C70000-0x0000000003C8A000-memory.dmp	upx
behavioral1/memory/2708-21-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/3048-25-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/files/0x0008000000015264-30.dat	upx
behavioral1/memory/2708-48-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/files/0x0008000000014fe1-53.dat	upx
behavioral1/memory/1104-70-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2464-74-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/files/0x000a000000014909-78.dat	upx
behavioral1/memory/1104-91-0x0000000003D70000-0x0000000003D8A000-memory.dmp	upx
behavioral1/memory/1104-98-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1456-93-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/files/0x0009000000015264-102.dat	upx
behavioral1/memory/1456-121-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1456-119-0x0000000003DB0000-0x0000000003DBB000-memory.dmp	upx
behavioral1/memory/1820-118-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/files/0x0009000000014fe1-136.dat	upx
behavioral1/memory/1820-139-0x0000000003940000-0x000000000395A000-memory.dmp	upx
behavioral1/memory/1820-144-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/files/0x000b000000014909-149.dat	upx
behavioral1/memory/2144-151-0x00000000037A0000-0x00000000037BA000-memory.dmp	upx
behavioral1/memory/2144-170-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1780-167-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/files/0x000a000000015264-175.dat	upx
behavioral1/memory/1780-194-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/files/0x000a000000014fe1-201.dat	upx
behavioral1/memory/2968-211-0x0000000003B30000-0x0000000003B4A000-memory.dmp	upx
behavioral1/memory/2968-216-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/files/0x000c000000014909-221.dat	upx
behavioral1/memory/2780-233-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2944-242-0x0000000003C60000-0x0000000003C7A000-memory.dmp	upx
behavioral1/memory/2944-248-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1872-249-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1872-266-0x0000000003DB0000-0x0000000003DBB000-memory.dmp	upx
behavioral1/memory/1652-265-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1872-264-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1872-261-0x0000000003BB0000-0x0000000003BCA000-memory.dmp	upx
behavioral1/memory/1652-283-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2660-291-0x0000000002F80000-0x0000000002F9A000-memory.dmp	upx
behavioral1/memory/2660-298-0x0000000002F80000-0x0000000002F8B000-memory.dmp	upx
behavioral1/memory/2660-300-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2072-313-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2860-314-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2860-329-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2084-330-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2084-347-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1544-366-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2276-364-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2588-382-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2276-381-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2588-399-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1640-397-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/2328-566-0x0000000000400000-0x000000000041A000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wwnngwr.exe	wti.exe
File opened for modification	C:\Windows\SysWOW64\whiwuq.exe	wbpdrm.exe
File opened for modification	C:\Windows\SysWOW64\wptanvidy.exe	wedkvaxu.exe
File opened for modification	C:\Windows\SysWOW64\wxjmqceh.exe	wirbgp.exe
File created	C:\Windows\SysWOW64\whmuem.exe	wtmcwro.exe
File created	C:\Windows\SysWOW64\wiqckxeuj.exe	wtsnmni.exe
File created	C:\Windows\SysWOW64\wohuqh.exe	wkihm.exe
File opened for modification	C:\Windows\SysWOW64\wfgkjxvtw.exe	wgxswciu.exe
File created	C:\Windows\SysWOW64\wti.exe	wakxahhx.exe
File created	C:\Windows\SysWOW64\woqfo.exe	whiwuq.exe
File created	C:\Windows\SysWOW64\wqasacqt.exe	wfidig.exe
File opened for modification	C:\Windows\SysWOW64\wjpnnkr.exe	wohuqh.exe
File created	C:\Windows\SysWOW64\wjenoy.exe	wcweswn.exe
File opened for modification	C:\Windows\SysWOW64\wkhcrbegy.exe	wtxenpyky.exe
File created	C:\Windows\SysWOW64\wtsnmni.exe	wxbsd.exe
File opened for modification	C:\Windows\SysWOW64\wtgwhbs.exe	wlrlaao.exe
File opened for modification	C:\Windows\SysWOW64\wgais.exe	wwwjrvmu.exe
File opened for modification	C:\Windows\SysWOW64\wsfebti.exe	whgxnep.exe
File created	C:\Windows\SysWOW64\wvmt.exe	wwnngwr.exe
File opened for modification	C:\Windows\SysWOW64\wucj.exe	wvmt.exe
File created	C:\Windows\SysWOW64\wachijmv.exe	worfu.exe
File opened for modification	C:\Windows\SysWOW64\wqiyb.exe	wxnuyera.exe
File created	C:\Windows\SysWOW64\wydayb.exe	wwkdoop.exe
File opened for modification	C:\Windows\SysWOW64\wmeffynp.exe	wjvsa.exe
File created	C:\Windows\SysWOW64\wtxenpyky.exe	wfu.exe
File opened for modification	C:\Windows\SysWOW64\wxnuyera.exe	wufjvsy.exe
File created	C:\Windows\SysWOW64\wwnqff.exe	wsfebti.exe
File created	C:\Windows\SysWOW64\wcqbifwcm.exe	whyea.exe
File created	C:\Windows\SysWOW64\wbpdrm.exe	wxwhha.exe
File opened for modification	C:\Windows\SysWOW64\wfcfthib.exe	wxjmqceh.exe
File opened for modification	C:\Windows\SysWOW64\wgfonvjmb.exe	wtgwhbs.exe
File created	C:\Windows\SysWOW64\wpmds.exe	wrmalys.exe
File opened for modification	C:\Windows\SysWOW64\wtlvjn.exe	wexoly.exe
File opened for modification	C:\Windows\SysWOW64\wfu.exe	wjenoy.exe
File opened for modification	C:\Windows\SysWOW64\wlrlaao.exe	wusjts.exe
File opened for modification	C:\Windows\SysWOW64\wqnxqx.exe	wdvuqgy.exe
File opened for modification	C:\Windows\SysWOW64\wugqv.exe	wnnvt.exe
File opened for modification	C:\Windows\SysWOW64\wlypgc.exe	woqfo.exe
File created	C:\Windows\SysWOW64\wxoagsvnk.exe	wlcydngjd.exe
File opened for modification	C:\Windows\SysWOW64\whmuem.exe	wtmcwro.exe
File created	C:\Windows\SysWOW64\wrymjfql.exe	wdpogukq.exe
File opened for modification	C:\Windows\SysWOW64\whgxnep.exe	wmeffynp.exe
File created	C:\Windows\SysWOW64\wkaau.exe	wynxrrjy.exe
File created	C:\Windows\SysWOW64\wqiyb.exe	wxnuyera.exe
File opened for modification	C:\Windows\SysWOW64\wiqckxeuj.exe	wtsnmni.exe
File opened for modification	C:\Windows\SysWOW64\wkknvfbe.exe	wqasacqt.exe
File created	C:\Windows\SysWOW64\wjvsa.exe	wgais.exe
File created	C:\Windows\SysWOW64\wopxyb.exe	wiqckxeuj.exe
File opened for modification	C:\Windows\SysWOW64\whyea.exe	wjpnnkr.exe
File created	C:\Windows\SysWOW64\wxwhha.exe	wucj.exe
File opened for modification	C:\Windows\SysWOW64\wedkvaxu.exe	wtrjigvne.exe
File opened for modification	C:\Windows\SysWOW64\wrmalys.exe	wbmmn.exe
File created	C:\Windows\SysWOW64\wvgvu.exe	wpmds.exe
File opened for modification	C:\Windows\SysWOW64\wvgvu.exe	wpmds.exe
File created	C:\Windows\SysWOW64\whgxnep.exe	wmeffynp.exe
File opened for modification	C:\Windows\SysWOW64\wbpdrm.exe	wxwhha.exe
File created	C:\Windows\SysWOW64\wkhcrbegy.exe	wtxenpyky.exe
File opened for modification	C:\Windows\SysWOW64\wjuh.exe	whmuem.exe
File created	C:\Windows\SysWOW64\wrmalys.exe	wbmmn.exe
File created	C:\Windows\SysWOW64\wdvuqgy.exe	wfmdem.exe
File created	C:\Windows\SysWOW64\wqnxqx.exe	wdvuqgy.exe
File opened for modification	C:\Windows\SysWOW64\wsvlukbhx.exe	wqnxqx.exe
File created	C:\Windows\SysWOW64\wlcydngjd.exe	wkhcrbegy.exe
File created	C:\Windows\SysWOW64\wirbgp.exe	wxoagsvnk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2708	3048	4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461.exe	28
PID 3048 wrote to memory of 2708	3048	4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461.exe	28
PID 3048 wrote to memory of 2708	3048	4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461.exe	28
PID 3048 wrote to memory of 2708	3048	4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461.exe	28
PID 3048 wrote to memory of 2848	3048	4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461.exe	29
PID 3048 wrote to memory of 2848	3048	4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461.exe	29
PID 3048 wrote to memory of 2848	3048	4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461.exe	29
PID 3048 wrote to memory of 2848	3048	4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461.exe	29
PID 2708 wrote to memory of 2464	2708	wkihm.exe	31
PID 2708 wrote to memory of 2464	2708	wkihm.exe	31
PID 2708 wrote to memory of 2464	2708	wkihm.exe	31
PID 2708 wrote to memory of 2464	2708	wkihm.exe	31
PID 2708 wrote to memory of 592	2708	wkihm.exe	32
PID 2708 wrote to memory of 592	2708	wkihm.exe	32
PID 2708 wrote to memory of 592	2708	wkihm.exe	32
PID 2708 wrote to memory of 592	2708	wkihm.exe	32
PID 2464 wrote to memory of 1104	2464	wohuqh.exe	34
PID 2464 wrote to memory of 1104	2464	wohuqh.exe	34
PID 2464 wrote to memory of 1104	2464	wohuqh.exe	34
PID 2464 wrote to memory of 1104	2464	wohuqh.exe	34
PID 2464 wrote to memory of 2920	2464	wohuqh.exe	35
PID 2464 wrote to memory of 2920	2464	wohuqh.exe	35
PID 2464 wrote to memory of 2920	2464	wohuqh.exe	35
PID 2464 wrote to memory of 2920	2464	wohuqh.exe	35
PID 1104 wrote to memory of 1456	1104	wjpnnkr.exe	37
PID 1104 wrote to memory of 1456	1104	wjpnnkr.exe	37
PID 1104 wrote to memory of 1456	1104	wjpnnkr.exe	37
PID 1104 wrote to memory of 1456	1104	wjpnnkr.exe	37
PID 1104 wrote to memory of 2656	1104	wjpnnkr.exe	38
PID 1104 wrote to memory of 2656	1104	wjpnnkr.exe	38
PID 1104 wrote to memory of 2656	1104	wjpnnkr.exe	38
PID 1104 wrote to memory of 2656	1104	wjpnnkr.exe	38
PID 1456 wrote to memory of 1820	1456	whyea.exe	40
PID 1456 wrote to memory of 1820	1456	whyea.exe	40
PID 1456 wrote to memory of 1820	1456	whyea.exe	40
PID 1456 wrote to memory of 1820	1456	whyea.exe	40
PID 1456 wrote to memory of 2296	1456	whyea.exe	41
PID 1456 wrote to memory of 2296	1456	whyea.exe	41
PID 1456 wrote to memory of 2296	1456	whyea.exe	41
PID 1456 wrote to memory of 2296	1456	whyea.exe	41
PID 1820 wrote to memory of 2144	1820	wcqbifwcm.exe	43
PID 1820 wrote to memory of 2144	1820	wcqbifwcm.exe	43
PID 1820 wrote to memory of 2144	1820	wcqbifwcm.exe	43
PID 1820 wrote to memory of 2144	1820	wcqbifwcm.exe	43
PID 1820 wrote to memory of 1056	1820	wcqbifwcm.exe	44
PID 1820 wrote to memory of 1056	1820	wcqbifwcm.exe	44
PID 1820 wrote to memory of 1056	1820	wcqbifwcm.exe	44
PID 1820 wrote to memory of 1056	1820	wcqbifwcm.exe	44
PID 2144 wrote to memory of 1780	2144	wlmnffi.exe	46
PID 2144 wrote to memory of 1780	2144	wlmnffi.exe	46
PID 2144 wrote to memory of 1780	2144	wlmnffi.exe	46
PID 2144 wrote to memory of 1780	2144	wlmnffi.exe	46
PID 2144 wrote to memory of 2204	2144	wlmnffi.exe	47
PID 2144 wrote to memory of 2204	2144	wlmnffi.exe	47
PID 2144 wrote to memory of 2204	2144	wlmnffi.exe	47
PID 2144 wrote to memory of 2204	2144	wlmnffi.exe	47
PID 1780 wrote to memory of 2968	1780	wjnql.exe	49
PID 1780 wrote to memory of 2968	1780	wjnql.exe	49
PID 1780 wrote to memory of 2968	1780	wjnql.exe	49
PID 1780 wrote to memory of 2968	1780	wjnql.exe	49
PID 1780 wrote to memory of 2988	1780	wjnql.exe	50
PID 1780 wrote to memory of 2988	1780	wjnql.exe	50
PID 1780 wrote to memory of 2988	1780	wjnql.exe	50
PID 1780 wrote to memory of 2988	1780	wjnql.exe	50

C:\Users\Admin\AppData\Local\Temp\4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461.exe
"C:\Users\Admin\AppData\Local\Temp\4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\wkihm.exe
  "C:\Windows\system32\wkihm.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\wohuqh.exe
    "C:\Windows\system32\wohuqh.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Windows\SysWOW64\wjpnnkr.exe
      "C:\Windows\system32\wjpnnkr.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1104
    - - C:\Windows\SysWOW64\whyea.exe
        
        "C:\Windows\system32\whyea.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1456
      - C:\Windows\SysWOW64\wcqbifwcm.exe
        
        "C:\Windows\system32\wcqbifwcm.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1820
        
        C:\Windows\SysWOW64\wlmnffi.exe
        
        "C:\Windows\system32\wlmnffi.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\SysWOW64\wjnql.exe
        
        "C:\Windows\system32\wjnql.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Windows\SysWOW64\wum.exe
        
        "C:\Windows\system32\wum.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2968
        
        C:\Windows\SysWOW64\wcld.exe
        
        "C:\Windows\system32\wcld.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2780
        
        C:\Windows\SysWOW64\wbvst.exe
        
        "C:\Windows\system32\wbvst.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2944
        
        C:\Windows\SysWOW64\wnnvt.exe
        
        "C:\Windows\system32\wnnvt.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1872
        
        C:\Windows\SysWOW64\wugqv.exe
        
        "C:\Windows\system32\wugqv.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1652
        
        C:\Windows\SysWOW64\wgxswciu.exe
        
        "C:\Windows\system32\wgxswciu.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2660
        
        C:\Windows\SysWOW64\wfgkjxvtw.exe
        
        "C:\Windows\system32\wfgkjxvtw.exe"
        15⤵
        Executes dropped EXE
        
        PID:2072
        
        C:\Windows\SysWOW64\wncwf.exe
        
        "C:\Windows\system32\wncwf.exe"
        16⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\SysWOW64\wynxrrjy.exe
        
        "C:\Windows\system32\wynxrrjy.exe"
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2084
        
        C:\Windows\SysWOW64\wkaau.exe
        
        "C:\Windows\system32\wkaau.exe"
        18⤵
        Executes dropped EXE
        
        PID:1544
        
        C:\Windows\SysWOW64\wakxahhx.exe
        
        "C:\Windows\system32\wakxahhx.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2276
        
        C:\Windows\SysWOW64\wti.exe
        
        "C:\Windows\system32\wti.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2588
        
        C:\Windows\SysWOW64\wwnngwr.exe
        
        "C:\Windows\system32\wwnngwr.exe"
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1640
        
        C:\Windows\SysWOW64\wvmt.exe
        
        "C:\Windows\system32\wvmt.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1832
        
        C:\Windows\SysWOW64\wucj.exe
        
        "C:\Windows\system32\wucj.exe"
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1652
        
        C:\Windows\SysWOW64\wxwhha.exe
        
        "C:\Windows\system32\wxwhha.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2028
        
        C:\Windows\SysWOW64\wbpdrm.exe
        
        "C:\Windows\system32\wbpdrm.exe"
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1880
        
        C:\Windows\SysWOW64\whiwuq.exe
        
        "C:\Windows\system32\whiwuq.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1656
        
        C:\Windows\SysWOW64\woqfo.exe
        
        "C:\Windows\system32\woqfo.exe"
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2720
        
        C:\Windows\SysWOW64\wlypgc.exe
        
        "C:\Windows\system32\wlypgc.exe"
        28⤵
        Executes dropped EXE
        
        PID:2100
        
        C:\Windows\SysWOW64\wtrjigvne.exe
        
        "C:\Windows\system32\wtrjigvne.exe"
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2276
        
        C:\Windows\SysWOW64\wedkvaxu.exe
        
        "C:\Windows\system32\wedkvaxu.exe"
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2328
        
        C:\Windows\SysWOW64\wptanvidy.exe
        
        "C:\Windows\system32\wptanvidy.exe"
        31⤵
        Executes dropped EXE
        
        PID:1616
        
        C:\Windows\SysWOW64\worfu.exe
        
        "C:\Windows\system32\worfu.exe"
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2320
        
        C:\Windows\SysWOW64\wachijmv.exe
        
        "C:\Windows\system32\wachijmv.exe"
        33⤵
        Executes dropped EXE
        
        PID:2884
        
        C:\Windows\SysWOW64\wcweswn.exe
        
        "C:\Windows\system32\wcweswn.exe"
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2880
        
        C:\Windows\SysWOW64\wjenoy.exe
        
        "C:\Windows\system32\wjenoy.exe"
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:320
        
        C:\Windows\SysWOW64\wfu.exe
        
        "C:\Windows\system32\wfu.exe"
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2864
        
        C:\Windows\SysWOW64\wtxenpyky.exe
        
        "C:\Windows\system32\wtxenpyky.exe"
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2696
        
        C:\Windows\SysWOW64\wkhcrbegy.exe
        
        "C:\Windows\system32\wkhcrbegy.exe"
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2552
        
        C:\Windows\SysWOW64\wlcydngjd.exe
        
        "C:\Windows\system32\wlcydngjd.exe"
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:876
        
        C:\Windows\SysWOW64\wxoagsvnk.exe
        
        "C:\Windows\system32\wxoagsvnk.exe"
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2960
        
        C:\Windows\SysWOW64\wirbgp.exe
        
        "C:\Windows\system32\wirbgp.exe"
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2992
        
        C:\Windows\SysWOW64\wxjmqceh.exe
        
        "C:\Windows\system32\wxjmqceh.exe"
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2312
        
        C:\Windows\SysWOW64\wfcfthib.exe
        
        "C:\Windows\system32\wfcfthib.exe"
        43⤵
        Executes dropped EXE
        
        PID:1012
        
        C:\Windows\SysWOW64\wtmcwro.exe
        
        "C:\Windows\system32\wtmcwro.exe"
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2792
        
        C:\Windows\SysWOW64\whmuem.exe
        
        "C:\Windows\system32\whmuem.exe"
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2208
        
        C:\Windows\SysWOW64\wjuh.exe
        
        "C:\Windows\system32\wjuh.exe"
        46⤵
        Executes dropped EXE
        
        PID:1556
        
        C:\Windows\SysWOW64\wufjvsy.exe
        
        "C:\Windows\system32\wufjvsy.exe"
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1684
        
        C:\Windows\SysWOW64\wxnuyera.exe
        
        "C:\Windows\system32\wxnuyera.exe"
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2040
        
        C:\Windows\SysWOW64\wqiyb.exe
        
        "C:\Windows\system32\wqiyb.exe"
        49⤵
        Executes dropped EXE
        
        PID:1840
        
        C:\Windows\SysWOW64\wxbsd.exe
        
        "C:\Windows\system32\wxbsd.exe"
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2644
        
        C:\Windows\SysWOW64\wtsnmni.exe
        
        "C:\Windows\system32\wtsnmni.exe"
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2632
        
        C:\Windows\SysWOW64\wiqckxeuj.exe
        
        "C:\Windows\system32\wiqckxeuj.exe"
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:432
        
        C:\Windows\SysWOW64\wopxyb.exe
        
        "C:\Windows\system32\wopxyb.exe"
        53⤵
        Executes dropped EXE
        
        PID:3064
        
        C:\Windows\SysWOW64\wdpogukq.exe
        
        "C:\Windows\system32\wdpogukq.exe"
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2968
        
        C:\Windows\SysWOW64\wrymjfql.exe
        
        "C:\Windows\system32\wrymjfql.exe"
        55⤵
        Executes dropped EXE
        
        PID:528
        
        C:\Windows\SysWOW64\wusjts.exe
        
        "C:\Windows\system32\wusjts.exe"
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:792
        
        C:\Windows\SysWOW64\wlrlaao.exe
        
        "C:\Windows\system32\wlrlaao.exe"
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2920
        
        C:\Windows\SysWOW64\wtgwhbs.exe
        
        "C:\Windows\system32\wtgwhbs.exe"
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2820
        
        C:\Windows\SysWOW64\wgfonvjmb.exe
        
        "C:\Windows\system32\wgfonvjmb.exe"
        59⤵
        Executes dropped EXE
        
        PID:2608
        
        C:\Windows\SysWOW64\widsrln.exe
        
        "C:\Windows\system32\widsrln.exe"
        60⤵
        Executes dropped EXE
        
        PID:1624
        
        C:\Windows\SysWOW64\wbmmn.exe
        
        "C:\Windows\system32\wbmmn.exe"
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1592
        
        C:\Windows\SysWOW64\wrmalys.exe
        
        "C:\Windows\system32\wrmalys.exe"
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:636
        
        C:\Windows\SysWOW64\wpmds.exe
        
        "C:\Windows\system32\wpmds.exe"
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1572
        
        C:\Windows\SysWOW64\wvgvu.exe
        
        "C:\Windows\system32\wvgvu.exe"
        64⤵
        Executes dropped EXE
        
        PID:3064
        
        C:\Windows\SysWOW64\wwkdoop.exe
        
        "C:\Windows\system32\wwkdoop.exe"
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2572
        
        C:\Windows\SysWOW64\wydayb.exe
        
        "C:\Windows\system32\wydayb.exe"
        66⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\wfidig.exe
        
        "C:\Windows\system32\wfidig.exe"
        67⤵
        Drops file in System32 directory
        
        PID:560
        
        C:\Windows\SysWOW64\wqasacqt.exe
        
        "C:\Windows\system32\wqasacqt.exe"
        68⤵
        Drops file in System32 directory
        
        PID:2920
        
        C:\Windows\SysWOW64\wkknvfbe.exe
        
        "C:\Windows\system32\wkknvfbe.exe"
        69⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\wrchyih.exe
        
        "C:\Windows\system32\wrchyih.exe"
        70⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\wexoly.exe
        
        "C:\Windows\system32\wexoly.exe"
        71⤵
        Drops file in System32 directory
        
        PID:1056
        
        C:\Windows\SysWOW64\wtlvjn.exe
        
        "C:\Windows\system32\wtlvjn.exe"
        72⤵
        
        PID:912
        
        C:\Windows\SysWOW64\wsxhpdx.exe
        
        "C:\Windows\system32\wsxhpdx.exe"
        73⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\wcthra.exe
        
        "C:\Windows\system32\wcthra.exe"
        74⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\wfmdem.exe
        
        "C:\Windows\system32\wfmdem.exe"
        75⤵
        Drops file in System32 directory
        
        PID:2236
        
        C:\Windows\SysWOW64\wdvuqgy.exe
        
        "C:\Windows\system32\wdvuqgy.exe"
        76⤵
        Drops file in System32 directory
        
        PID:1604
        
        C:\Windows\SysWOW64\wqnxqx.exe
        
        "C:\Windows\system32\wqnxqx.exe"
        77⤵
        Drops file in System32 directory
        
        PID:2460
        
        C:\Windows\SysWOW64\wsvlukbhx.exe
        
        "C:\Windows\system32\wsvlukbhx.exe"
        78⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\wwwjrvmu.exe
        
        "C:\Windows\system32\wwwjrvmu.exe"
        79⤵
        Drops file in System32 directory
        
        PID:2128
        
        C:\Windows\SysWOW64\wgais.exe
        
        "C:\Windows\system32\wgais.exe"
        80⤵
        Drops file in System32 directory
        
        PID:2284
        
        C:\Windows\SysWOW64\wjvsa.exe
        
        "C:\Windows\system32\wjvsa.exe"
        81⤵
        Drops file in System32 directory
        
        PID:2900
        
        C:\Windows\SysWOW64\wmeffynp.exe
        
        "C:\Windows\system32\wmeffynp.exe"
        82⤵
        Drops file in System32 directory
        
        PID:2028
        
        C:\Windows\SysWOW64\whgxnep.exe
        
        "C:\Windows\system32\whgxnep.exe"
        83⤵
        Drops file in System32 directory
        
        PID:2844
        
        C:\Windows\SysWOW64\wsfebti.exe
        
        "C:\Windows\system32\wsfebti.exe"
        84⤵
        Drops file in System32 directory
        
        PID:608
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whgxnep.exe"
        84⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmeffynp.exe"
        83⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjvsa.exe"
        82⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgais.exe"
        81⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwwjrvmu.exe"
        80⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsvlukbhx.exe"
        79⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqnxqx.exe"
        78⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdvuqgy.exe"
        77⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfmdem.exe"
        76⤵
        
        PID:792
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcthra.exe"
        75⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsxhpdx.exe"
        74⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtlvjn.exe"
        73⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wexoly.exe"
        72⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrchyih.exe"
        71⤵
        
        PID:764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkknvfbe.exe"
        70⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqasacqt.exe"
        69⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfidig.exe"
        68⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wydayb.exe"
        67⤵
        
        PID:896
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwkdoop.exe"
        66⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvgvu.exe"
        65⤵
        
        PID:584
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpmds.exe"
        64⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrmalys.exe"
        63⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbmmn.exe"
        62⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\widsrln.exe"
        61⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgfonvjmb.exe"
        60⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtgwhbs.exe"
        59⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlrlaao.exe"
        58⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wusjts.exe"
        57⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrymjfql.exe"
        56⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdpogukq.exe"
        55⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wopxyb.exe"
        54⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wiqckxeuj.exe"
        53⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtsnmni.exe"
        52⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxbsd.exe"
        51⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqiyb.exe"
        50⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxnuyera.exe"
        49⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wufjvsy.exe"
        48⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjuh.exe"
        47⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whmuem.exe"
        46⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtmcwro.exe"
        45⤵
        
        PID:892
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfcfthib.exe"
        44⤵
        
        PID:920
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxjmqceh.exe"
        43⤵
        
        PID:852
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wirbgp.exe"
        42⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxoagsvnk.exe"
        41⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlcydngjd.exe"
        40⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkhcrbegy.exe"
        39⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtxenpyky.exe"
        38⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfu.exe"
        37⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjenoy.exe"
        36⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcweswn.exe"
        35⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wachijmv.exe"
        34⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\worfu.exe"
        33⤵
        
        PID:764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wptanvidy.exe"
        32⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wedkvaxu.exe"
        31⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtrjigvne.exe"
        30⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlypgc.exe"
        29⤵
        
        PID:896
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\woqfo.exe"
        28⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whiwuq.exe"
        27⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbpdrm.exe"
        26⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxwhha.exe"
        25⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wucj.exe"
        24⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvmt.exe"
        23⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwnngwr.exe"
        22⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wti.exe"
        21⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wakxahhx.exe"
        20⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkaau.exe"
        19⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wynxrrjy.exe"
        18⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wncwf.exe"
        17⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfgkjxvtw.exe"
        16⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgxswciu.exe"
        15⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wugqv.exe"
        14⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wnnvt.exe"
        13⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbvst.exe"
        12⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcld.exe"
        11⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wum.exe"
        10⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjnql.exe"
        9⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlmnffi.exe"
        8⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcqbifwcm.exe"
        7⤵
        
        PID:1056
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whyea.exe"
        6⤵
        
        PID:2296
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjpnnkr.exe"
        5⤵
        
        PID:2656
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wohuqh.exe"
      4⤵
      PID:2920
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkihm.exe"
    3⤵
    PID:592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\4b8f92aa6a002e641841214c6aff942cf2f44cbfb4ef570817a547638c277461.exe"
  2⤵
  - Deletes itself
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DH7YVMUY.txt

Filesize
99B

MD5
b5a1d13993f5e7b3317878dc33bc88ea

SHA1
901fd7101471c272ad9ca22a96a90771800f8857

SHA256
f2de45600f95bcc63b4e2006d08a38ef59132cb3d9f754886069054b9cd3a411

SHA512
6323c8609acf9be563ff9a21d81dbfe5438eef8cbb01f658b3cb1c6a784582c6b6c8aff91c48c426e0827eb0803c10b56f627c7a1b781211e90588f593e801ec

Download Submit
\Windows\SysWOW64\wbvst.exe

Filesize
43KB

MD5
a89ec400de1577cb827c9fe70abe9f00

SHA1
3cbdfba8abd5baddf4e974b76aa669aea7f211b9

SHA256
a08e04c2bacb1634f2a70ea9a8e3090c6c7c5be9ae8116d68d458bf3c2813ebb

SHA512
ffb0d953d4690dd5fc3ccf2ca3a3fd2ec16eade0538858b09d83bcbc31b2ca266368d00cd643dcf04060325116a553fb39dd289fca19ef79b6572781fac40ef8

Download Submit
\Windows\SysWOW64\wcld.exe

Filesize
43KB

MD5
aa5aa5c3edb65258b56782e4589fefba

SHA1
1419c6c3371509529eb8220e4e3caa16aed597fa

SHA256
994368d42a04256d26c4fbbf62b7beb50658755b67635bf6b8e5e7f997a30b9a

SHA512
5612f9bc203c1e1fb3c740cf559ecb723d5878ed49dc9841eb40fb7e8740b4f2450de72542eed9bcec6b26298de7eb3307e0062ba71ecb6c5595f8a5f4260c4d

Download Submit
\Windows\SysWOW64\wcqbifwcm.exe

Filesize
43KB

MD5
5767349b1c2b7a392e4a980fbaad5d28

SHA1
0008765681a6fc235715ace1b02373d7bcbb2deb

SHA256
4d13a12f10397077fa1b5208e5a689a6f2ad47774027a2acec508a5ef545ccb5

SHA512
6072dfd71d9efccb6bcd3c102ecf03a0ee0ae53e39bf92bab632a4ce299ccf4553095ad433449b07d035117947efbbbcaf2146ea28f7fe34888bfb36678081ea

Download Submit
\Windows\SysWOW64\whyea.exe

Filesize
43KB

MD5
70ad291b3eacd3ddeb09fa3fdb35103a

SHA1
2811f1f84e1ec587ad4de566e9d26c340a7fd26a

SHA256
1f02689b4407cd6d855cb0c84d0140cd4e9f1798de82940893fd16412550c656

SHA512
1d576ef662612ef1700013d637b8163f9c5bc5b487da5ace44ba643a79e8bf082497764837381154529175e5ba1b476caa0d3d385d8f9f62ff8d28e9ab6b8ec9

Download Submit
\Windows\SysWOW64\wjnql.exe

Filesize
43KB

MD5
c8dd16d3cbbe67f80675f6aae5d48c56

SHA1
e62d795d923b363ca685da6c95877f7a42b4e4ca

SHA256
367a7728fdbed9da28243abdca38ea6b9db34706a38c7c69082468dc0c9833cb

SHA512
375cb30b62fa0bf69fabbe9eacf69c6c01a7cb7628ee301e1c76bc084ca15f195a0a75b0b5b38466d73d12749a1379fa50ad7f6c9d5b188e92c4393252299e06

Download Submit
\Windows\SysWOW64\wjpnnkr.exe

Filesize
43KB

MD5
e6a0fc7e2d6140d61acfef26b880ed09

SHA1
c53f5f033b610bf9e7cac68fe64fc8774acfb99a

SHA256
fdc1e534db4fb7008449cfefbd1292fb58d05a818c87f6bdc3fb2816ef5c169f

SHA512
582684c5eec868e42a011f99dfc15a6a534e1feb8fe1013a7b71942d23a0f5995a5ae8764f0cd9708c7520d923c81d871c1130a935b9a6b21ddc1a041c93cac9

Download Submit
\Windows\SysWOW64\wkihm.exe

Filesize
42KB

MD5
a5e05dd8876bab0afa82ab42c0dc2f1f

SHA1
020e1133e588b19addd33acc197f942bf9a6a1ff

SHA256
25ee0b9f10586bfa6895a487845a64a2a417ac0bb03378844c325d75eba94f93

SHA512
21bbc17f9d00a4cfb5cdd383028a96494eb23c3338eabacaf42e5f9a100d280b83fd17e2952a3c843ec30803e6d548d1324a19b3c6f6e435117331f591d9e4e8

Download Submit
\Windows\SysWOW64\wlmnffi.exe

Filesize
43KB

MD5
593757b3e3b1dec8a7f27eee1f277190

SHA1
d1396e86be7d500a9c266cdced0e222e78ecc283

SHA256
860a998a1e0fa326aadc345cb8df3ff51562222a9eba404768408d941ee0ddf9

SHA512
e5f2d8f5607cef12a0e6c488f31b7596441a15067bcb9044da6b584eee3b9533c93ac2d329f3d791e78114a49d2fcaaef0754346a563376548df66198a06ac06

Download Submit
\Windows\SysWOW64\wohuqh.exe

Filesize
43KB

MD5
8ed0b0a1b1b77e641f5e9a45d0e56c79

SHA1
89c4b1bd4e9d5faf3e36c0fd95f0493273daa76d

SHA256
cd97157529da9d844ef59e810014131f1f78bac5c98c74394ebe84ce3b8e8f2e

SHA512
937bd9696fef4a12e56740e4b0d8b2eec4924576b880509c80131d5d2681dae1feed8e192f9834889a3788a0b22092946fd075904bef193fa9d3023a0f0a1e8c

Download Submit
\Windows\SysWOW64\wum.exe

Filesize
43KB

MD5
6c76ccb62e3c2c89e86825c1c0f4c1bd

SHA1
d7fa300f222979c46649ba8a158287118b7a9702

SHA256
8fa047ab12913fcbf9f62e46ee9c6b1fde38599bf73e8cfaacce7a3345154e3c

SHA512
c4e373956ab6d88489890468188698f3ced8f1ac7ddf17899fb2e5d588c530975b645fa70f89d8b883beea3a389df0d937829fa2919ababc2d95ab550f7ae42a

Download Submit
memory/1104-98-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1104-84-0x0000000003C70000-0x0000000003C8A000-memory.dmp

Filesize
104KB

Download
memory/1104-70-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1104-95-0x0000000003D70000-0x0000000003D7B000-memory.dmp

Filesize
44KB

Download
memory/1104-91-0x0000000003D70000-0x0000000003D8A000-memory.dmp

Filesize
104KB

Download
memory/1456-119-0x0000000003DB0000-0x0000000003DBB000-memory.dmp

Filesize
44KB

Download
memory/1456-121-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1456-108-0x0000000003DA0000-0x0000000003DBA000-memory.dmp

Filesize
104KB

Download
memory/1456-109-0x0000000003DA0000-0x0000000003DBA000-memory.dmp

Filesize
104KB

Download
memory/1456-93-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1544-361-0x00000000033E0000-0x00000000033FA000-memory.dmp

Filesize
104KB

Download
memory/1544-366-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1544-365-0x00000000033E0000-0x00000000033EB000-memory.dmp

Filesize
44KB

Download
memory/1544-362-0x00000000033E0000-0x00000000033FA000-memory.dmp

Filesize
104KB

Download
memory/1544-357-0x00000000033D0000-0x00000000033EA000-memory.dmp

Filesize
104KB

Download
memory/1544-355-0x00000000033D0000-0x00000000033EA000-memory.dmp

Filesize
104KB

Download
memory/1640-411-0x0000000003A50000-0x0000000003A6A000-memory.dmp

Filesize
104KB

Download
memory/1640-397-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1652-278-0x0000000003B20000-0x0000000003B3A000-memory.dmp

Filesize
104KB

Download
memory/1652-279-0x0000000003B20000-0x0000000003B3A000-memory.dmp

Filesize
104KB

Download
memory/1652-280-0x0000000003B30000-0x0000000003B4A000-memory.dmp

Filesize
104KB

Download
memory/1652-281-0x0000000003B30000-0x0000000003B4A000-memory.dmp

Filesize
104KB

Download
memory/1652-283-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1652-265-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1780-167-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1780-194-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1780-192-0x0000000003620000-0x000000000362B000-memory.dmp

Filesize
44KB

Download
memory/1780-189-0x0000000003C80000-0x0000000003C9A000-memory.dmp

Filesize
104KB

Download
memory/1780-182-0x0000000003B20000-0x0000000003B3A000-memory.dmp

Filesize
104KB

Download
memory/1780-181-0x0000000003B20000-0x0000000003B3A000-memory.dmp

Filesize
104KB

Download
memory/1820-118-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1820-144-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1820-139-0x0000000003940000-0x000000000395A000-memory.dmp

Filesize
104KB

Download
memory/1820-138-0x0000000003940000-0x000000000395A000-memory.dmp

Filesize
104KB

Download
memory/1820-140-0x0000000003940000-0x000000000395A000-memory.dmp

Filesize
104KB

Download
memory/1872-263-0x0000000003DB0000-0x0000000003DCA000-memory.dmp

Filesize
104KB

Download
memory/1872-249-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1872-261-0x0000000003BB0000-0x0000000003BCA000-memory.dmp

Filesize
104KB

Download
memory/1872-264-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1872-266-0x0000000003DB0000-0x0000000003DBB000-memory.dmp

Filesize
44KB

Download
memory/1872-262-0x0000000003DB0000-0x0000000003DCA000-memory.dmp

Filesize
104KB

Download
memory/2072-313-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2084-344-0x0000000003C80000-0x0000000003C9A000-memory.dmp

Filesize
104KB

Download
memory/2084-330-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2084-342-0x0000000003A70000-0x0000000003A8A000-memory.dmp

Filesize
104KB

Download
memory/2084-343-0x0000000003C80000-0x0000000003C9A000-memory.dmp

Filesize
104KB

Download
memory/2084-347-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2084-345-0x0000000003A80000-0x0000000003A8B000-memory.dmp

Filesize
44KB

Download
memory/2144-162-0x00000000037A0000-0x00000000037BA000-memory.dmp

Filesize
104KB

Download
memory/2144-170-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2144-168-0x00000000037B0000-0x00000000037BB000-memory.dmp

Filesize
44KB

Download
memory/2144-163-0x0000000003BD0000-0x0000000003BEA000-memory.dmp

Filesize
104KB

Download
memory/2144-164-0x0000000003BD0000-0x0000000003BEA000-memory.dmp

Filesize
104KB

Download
memory/2144-151-0x00000000037A0000-0x00000000037BA000-memory.dmp

Filesize
104KB

Download
memory/2276-375-0x0000000003DA0000-0x0000000003DBA000-memory.dmp

Filesize
104KB

Download
memory/2276-381-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2276-379-0x0000000003DB0000-0x0000000003DCA000-memory.dmp

Filesize
104KB

Download
memory/2276-364-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2328-566-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2464-72-0x0000000003C70000-0x0000000003C7B000-memory.dmp

Filesize
44KB

Download
memory/2464-65-0x0000000003C60000-0x0000000003C7A000-memory.dmp

Filesize
104KB

Download
memory/2464-74-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2464-66-0x0000000003C60000-0x0000000003C7A000-memory.dmp

Filesize
104KB

Download
memory/2464-67-0x0000000003C70000-0x0000000003C8A000-memory.dmp

Filesize
104KB

Download
memory/2588-399-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2588-398-0x0000000003AC0000-0x0000000003ACB000-memory.dmp

Filesize
44KB

Download
memory/2588-394-0x0000000003AB0000-0x0000000003ACA000-memory.dmp

Filesize
104KB

Download
memory/2588-382-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2588-395-0x0000000003AC0000-0x0000000003ADA000-memory.dmp

Filesize
104KB

Download
memory/2660-291-0x0000000002F80000-0x0000000002F9A000-memory.dmp

Filesize
104KB

Download
memory/2660-297-0x0000000002F80000-0x0000000002F9A000-memory.dmp

Filesize
104KB

Download
memory/2660-300-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2660-298-0x0000000002F80000-0x0000000002F8B000-memory.dmp

Filesize
44KB

Download
memory/2660-296-0x0000000002F80000-0x0000000002F9A000-memory.dmp

Filesize
104KB

Download
memory/2708-42-0x0000000003C70000-0x0000000003C8A000-memory.dmp

Filesize
104KB

Download
memory/2708-43-0x0000000003C70000-0x0000000003C8A000-memory.dmp

Filesize
104KB

Download
memory/2708-48-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2708-21-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2708-46-0x0000000003A50000-0x0000000003A5B000-memory.dmp

Filesize
44KB

Download
memory/2780-232-0x00000000035B0000-0x00000000035BB000-memory.dmp

Filesize
44KB

Download
memory/2780-233-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2780-226-0x0000000003C40000-0x0000000003C5A000-memory.dmp

Filesize
104KB

Download
memory/2860-314-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2860-327-0x0000000003C40000-0x0000000003C5A000-memory.dmp

Filesize
104KB

Download
memory/2860-328-0x0000000003C40000-0x0000000003C5A000-memory.dmp

Filesize
104KB

Download
memory/2860-329-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2860-326-0x00000000039E0000-0x00000000039FA000-memory.dmp

Filesize
104KB

Download
memory/2944-248-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2944-241-0x0000000003C60000-0x0000000003C7A000-memory.dmp

Filesize
104KB

Download
memory/2944-242-0x0000000003C60000-0x0000000003C7A000-memory.dmp

Filesize
104KB

Download
memory/2968-211-0x0000000003B30000-0x0000000003B4A000-memory.dmp

Filesize
104KB

Download
memory/2968-215-0x0000000003B30000-0x0000000003B3B000-memory.dmp

Filesize
44KB

Download
memory/2968-216-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3048-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3048-25-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3048-22-0x0000000003C70000-0x0000000003C7B000-memory.dmp

Filesize
44KB

Download
memory/3048-18-0x0000000003C70000-0x0000000003C8A000-memory.dmp

Filesize
104KB

Download
memory/3048-19-0x0000000003C70000-0x0000000003C8A000-memory.dmp

Filesize
104KB

Download
memory/3048-11-0x0000000003C60000-0x0000000003C7A000-memory.dmp

Filesize
104KB

Download