Overview

overview

10

Static

static

setup_x86_...0).exe

windows7_x64

10

setup_x86_...0).exe

windows10_x64

10

setup_x86_...1).exe

windows7_x64

setup_x86_...1).exe

windows10_x64

setup_x86_...2).exe

windows7_x64

setup_x86_...2).exe

windows10_x64

10

setup_x86_...3).exe

windows7_x64

setup_x86_...3).exe

windows10_x64

10

setup_x86_...4).exe

windows7_x64

setup_x86_...4).exe

windows10_x64

10

setup_x86_...5).exe

windows7_x64

setup_x86_...5).exe

windows10_x64

10

setup_x86_...6).exe

windows7_x64

10

setup_x86_...6).exe

windows10_x64

10

setup_x86_...7).exe

windows7_x64

setup_x86_...7).exe

windows10_x64

10

setup_x86_...8).exe

windows7_x64

setup_x86_...8).exe

windows10_x64

10

setup_x86_...9).exe

windows7_x64

10

setup_x86_...9).exe

windows10_x64

10

setup_x86_...2).exe

windows7_x64

10

setup_x86_...2).exe

windows10_x64

10

setup_x86_...0).exe

windows7_x64

10

setup_x86_...0).exe

windows10_x64

10

setup_x86_...1).exe

windows7_x64

setup_x86_...1).exe

windows10_x64

10

setup_x86_...2).exe

windows7_x64

setup_x86_...2).exe

windows10_x64

10

setup_x86_...3).exe

windows7_x64

setup_x86_...3).exe

windows10_x64

10

setup_x86_...3).exe

windows7_x64

10

setup_x86_...3).exe

windows10_x64

Resubmissions

11-07-2024 05:43

240711-gej4lstgrf 10

06-09-2021 14:13

210906-rjpvrsedbm 10

08-07-2021 11:08

210708-4gztl3mwl6 10

08-07-2021 08:02

210708-klfb4qeda6 10

07-07-2021 09:39

210707-nem57xyvf2 10

06-07-2021 17:51

210706-7pcrmjy3fa 10

06-07-2021 13:45

210706-eybelwcq86 10

Analysis

  • max time kernel
    1801s
  • max time network
    1808s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    02-07-2021 07:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_x86_x64_install - копия (16).exe

Score
10/10
redlinesmokeloadervidar706865servaniaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealerthemidatrojanupx

Malware Config

Extracted

Family

redline

Botnet

ServAni

C2

87.251.71.195:82

Extracted

Family

vidar

Version

39.4

Botnet

706

C2

https://sergeevih43.tumblr.com

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/
rc4.i32
rc4.i32

Extracted

Family

vidar

Version

39.4

Botnet

865

C2

https://sergeevih43.tumblr.com

Attributes
  • profile_id

    865

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Vidar Stealer 5 IoCs
    stealer
  • ASPack v2.12-2.42 8 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 48 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 18 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 10 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:68
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2724
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2852
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
          PID:2740
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2432
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2424
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1820
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1404
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1224
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1184
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1064
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      PID:676
                      • C:\Users\Admin\AppData\Roaming\rfisijd
                        C:\Users\Admin\AppData\Roaming\rfisijd
                        2⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: MapViewOfSection
                        PID:5760
                      • C:\Users\Admin\AppData\Roaming\rfisijd
                        C:\Users\Admin\AppData\Roaming\rfisijd
                        2⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: MapViewOfSection
                        PID:5632
                      • C:\Users\Admin\AppData\Roaming\rfisijd
                        C:\Users\Admin\AppData\Roaming\rfisijd
                        2⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: MapViewOfSection
                        PID:2112
                    • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (16).exe
                      "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (16).exe"
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3992
                      • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                        "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:2276
                        • C:\Users\Admin\AppData\Local\Temp\7zS4E81A044\setup_install.exe
                          "C:\Users\Admin\AppData\Local\Temp\7zS4E81A044\setup_install.exe"
                          3⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of WriteProcessMemory
                          PID:2968
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c arnatic_1.exe
                            4⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2772
                            • C:\Users\Admin\AppData\Local\Temp\7zS4E81A044\arnatic_1.exe
                              arnatic_1.exe
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Checks processor information in registry
                              PID:2136
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c taskkill /im arnatic_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS4E81A044\arnatic_1.exe" & del C:\ProgramData\*.dll & exit
                                6⤵
                                  PID:3888
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /im arnatic_1.exe /f
                                    7⤵
                                    • Kills process with taskkill
                                    PID:4648
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout /t 6
                                    7⤵
                                    • Delays execution with timeout.exe
                                    PID:1348
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c arnatic_2.exe
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3224
                              • C:\Users\Admin\AppData\Local\Temp\7zS4E81A044\arnatic_2.exe
                                arnatic_2.exe
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks SCSI registry key(s)
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: MapViewOfSection
                                PID:400
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c arnatic_3.exe
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3296
                              • C:\Users\Admin\AppData\Local\Temp\7zS4E81A044\arnatic_3.exe
                                arnatic_3.exe
                                5⤵
                                • Executes dropped EXE
                                • Checks computer location settings
                                • Suspicious use of WriteProcessMemory
                                PID:3960
                                • C:\Windows\SysWOW64\rUNdlL32.eXe
                                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                  6⤵
                                  • Loads dropped DLL
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:2088
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c arnatic_4.exe
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:8
                              • C:\Users\Admin\AppData\Local\Temp\7zS4E81A044\arnatic_4.exe
                                arnatic_4.exe
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:1076
                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                  6⤵
                                  • Executes dropped EXE
                                  PID:2208
                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4840
                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                  6⤵
                                  • Executes dropped EXE
                                  PID:5552
                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                  6⤵
                                  • Executes dropped EXE
                                  PID:2088
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c arnatic_6.exe
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1164
                              • C:\Users\Admin\AppData\Local\Temp\7zS4E81A044\arnatic_6.exe
                                arnatic_6.exe
                                5⤵
                                • Executes dropped EXE
                                • Checks computer location settings
                                PID:2092
                                • C:\Users\Admin\Documents\QxT9SuJAsOFkolKaIqyRsFCT.exe
                                  "C:\Users\Admin\Documents\QxT9SuJAsOFkolKaIqyRsFCT.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:4796
                                  • C:\Users\Admin\Documents\QxT9SuJAsOFkolKaIqyRsFCT.exe
                                    C:\Users\Admin\Documents\QxT9SuJAsOFkolKaIqyRsFCT.exe
                                    7⤵
                                    • Executes dropped EXE
                                    PID:4920
                                • C:\Users\Admin\Documents\uY_Rid46kRdK7yAC7iej1rJA.exe
                                  "C:\Users\Admin\Documents\uY_Rid46kRdK7yAC7iej1rJA.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Checks BIOS information in registry
                                  • Checks whether UAC is enabled
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  PID:4924
                                • C:\Users\Admin\Documents\YCpemRXFHNvCEjOag8eCHEm4.exe
                                  "C:\Users\Admin\Documents\YCpemRXFHNvCEjOag8eCHEm4.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:3788
                                  • C:\Users\Admin\Documents\YCpemRXFHNvCEjOag8eCHEm4.exe
                                    "{path}"
                                    7⤵
                                    • Executes dropped EXE
                                    PID:2504
                                • C:\Users\Admin\Documents\ZZQ8VFWvfaPGxS9Wm_r334kv.exe
                                  "C:\Users\Admin\Documents\ZZQ8VFWvfaPGxS9Wm_r334kv.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks processor information in registry
                                  PID:3856
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /im ZZQ8VFWvfaPGxS9Wm_r334kv.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\ZZQ8VFWvfaPGxS9Wm_r334kv.exe" & del C:\ProgramData\*.dll & exit
                                    7⤵
                                      PID:2136
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /im ZZQ8VFWvfaPGxS9Wm_r334kv.exe /f
                                        8⤵
                                        • Kills process with taskkill
                                        PID:3576
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout /t 6
                                        8⤵
                                        • Delays execution with timeout.exe
                                        PID:4904
                                  • C:\Users\Admin\Documents\takeRSv2wnBdibAtLuoRCeP1.exe
                                    "C:\Users\Admin\Documents\takeRSv2wnBdibAtLuoRCeP1.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Checks computer location settings
                                    PID:4896
                                    • C:\Users\Admin\AppData\Local\Temp\56325685.exe
                                      C:\Users\Admin\AppData\Local\Temp\56325685.exe
                                      7⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:4140
                                      • C:\Users\Admin\AppData\Local\Temp\56325685.exe
                                        C:\Users\Admin\AppData\Local\Temp\56325685.exe
                                        8⤵
                                        • Executes dropped EXE
                                        PID:2920
                                    • C:\Users\Admin\AppData\Local\Temp\1402383870.exe
                                      C:\Users\Admin\AppData\Local\Temp\1402383870.exe
                                      7⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:5332
                                      • C:\Users\Admin\AppData\Local\Temp\1402383870.exe
                                        C:\Users\Admin\AppData\Local\Temp\1402383870.exe
                                        8⤵
                                        • Executes dropped EXE
                                        PID:5404
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\Documents\takeRSv2wnBdibAtLuoRCeP1.exe & exit
                                      7⤵
                                        PID:4612
                                        • C:\Windows\SysWOW64\PING.EXE
                                          ping 0
                                          8⤵
                                          • Runs ping.exe
                                          PID:2772
                                    • C:\Users\Admin\Documents\67E71S3tRJ27jqiK6GX_Zmex.exe
                                      "C:\Users\Admin\Documents\67E71S3tRJ27jqiK6GX_Zmex.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:4612
                                      • C:\Users\Admin\Documents\67E71S3tRJ27jqiK6GX_Zmex.exe
                                        C:\Users\Admin\Documents\67E71S3tRJ27jqiK6GX_Zmex.exe
                                        7⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Checks processor information in registry
                                        PID:4224
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c taskkill /im 67E71S3tRJ27jqiK6GX_Zmex.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\67E71S3tRJ27jqiK6GX_Zmex.exe" & del C:\ProgramData\*.dll & exit
                                          8⤵
                                            PID:5536
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /im 67E71S3tRJ27jqiK6GX_Zmex.exe /f
                                              9⤵
                                              • Kills process with taskkill
                                              PID:5576
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout /t 6
                                              9⤵
                                              • Delays execution with timeout.exe
                                              PID:5604
                                        • C:\Users\Admin\Documents\67E71S3tRJ27jqiK6GX_Zmex.exe
                                          C:\Users\Admin\Documents\67E71S3tRJ27jqiK6GX_Zmex.exe
                                          7⤵
                                          • Executes dropped EXE
                                          PID:740
                                        • C:\Users\Admin\Documents\67E71S3tRJ27jqiK6GX_Zmex.exe
                                          C:\Users\Admin\Documents\67E71S3tRJ27jqiK6GX_Zmex.exe
                                          7⤵
                                          • Executes dropped EXE
                                          PID:4804
                                        • C:\Users\Admin\Documents\67E71S3tRJ27jqiK6GX_Zmex.exe
                                          C:\Users\Admin\Documents\67E71S3tRJ27jqiK6GX_Zmex.exe
                                          7⤵
                                          • Executes dropped EXE
                                          PID:4976
                                      • C:\Users\Admin\Documents\SQlqBQbdvu5uBCYJp3oYKH5P.exe
                                        "C:\Users\Admin\Documents\SQlqBQbdvu5uBCYJp3oYKH5P.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        PID:4516
                                        • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                          "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          PID:4320
                                        • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                          "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          PID:4284
                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                            8⤵
                                            • Executes dropped EXE
                                            PID:4892
                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                            8⤵
                                            • Executes dropped EXE
                                            PID:420
                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                            8⤵
                                            • Executes dropped EXE
                                            PID:4868
                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                            8⤵
                                            • Executes dropped EXE
                                            PID:4388
                                        • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                          "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          • Checks computer location settings
                                          PID:2792
                                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                            8⤵
                                            • Loads dropped DLL
                                            • Modifies registry class
                                            PID:5008
                                        • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                          "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Drops file in Program Files directory
                                          PID:3996
                                      • C:\Users\Admin\Documents\vXRBAH0ZuIkMHGBO7ZmUj3KR.exe
                                        "C:\Users\Admin\Documents\vXRBAH0ZuIkMHGBO7ZmUj3KR.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        PID:4704
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --hold https://ezsearch.ru
                                          7⤵
                                          • Loads dropped DLL
                                          • Enumerates system info in registry
                                          • Suspicious use of FindShellTrayWindow
                                          PID:1724
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd8,0xdc,0xe0,0xb4,0xe4,0x7ffdee554f50,0x7ffdee554f60,0x7ffdee554f70
                                            8⤵
                                              PID:1508
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1512 /prefetch:2
                                              8⤵
                                                PID:636
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1900 /prefetch:8
                                                8⤵
                                                  PID:1732
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 /prefetch:8
                                                  8⤵
                                                    PID:5096
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2804 /prefetch:1
                                                    8⤵
                                                      PID:2060
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2820 /prefetch:1
                                                      8⤵
                                                        PID:4336
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
                                                        8⤵
                                                          PID:3984
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
                                                          8⤵
                                                            PID:3636
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
                                                            8⤵
                                                              PID:1380
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
                                                              8⤵
                                                                PID:2168
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4840 /prefetch:8
                                                                8⤵
                                                                  PID:848
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
                                                                  8⤵
                                                                    PID:3172
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5708 /prefetch:8
                                                                    8⤵
                                                                      PID:4652
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
                                                                      8⤵
                                                                        PID:2136
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5584 /prefetch:8
                                                                        8⤵
                                                                          PID:1516
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5320 /prefetch:8
                                                                          8⤵
                                                                            PID:3720
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                                                            8⤵
                                                                              PID:4540
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff794e1a890,0x7ff794e1a8a0,0x7ff794e1a8b0
                                                                                9⤵
                                                                                  PID:3292
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5388 /prefetch:8
                                                                                8⤵
                                                                                  PID:5016
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
                                                                                  8⤵
                                                                                    PID:4432
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6020 /prefetch:8
                                                                                    8⤵
                                                                                      PID:4004
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5272 /prefetch:8
                                                                                      8⤵
                                                                                        PID:4324
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6040 /prefetch:8
                                                                                        8⤵
                                                                                          PID:4508
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5128 /prefetch:8
                                                                                          8⤵
                                                                                            PID:1364
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4884 /prefetch:8
                                                                                            8⤵
                                                                                              PID:1304
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3908 /prefetch:8
                                                                                              8⤵
                                                                                                PID:2792
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3892 /prefetch:8
                                                                                                8⤵
                                                                                                  PID:4104
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5876 /prefetch:8
                                                                                                  8⤵
                                                                                                    PID:5124
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6264 /prefetch:8
                                                                                                    8⤵
                                                                                                      PID:5172
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5720 /prefetch:8
                                                                                                      8⤵
                                                                                                        PID:5236
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5580 /prefetch:8
                                                                                                        8⤵
                                                                                                          PID:5268
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5708 /prefetch:8
                                                                                                          8⤵
                                                                                                            PID:5300
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6240 /prefetch:8
                                                                                                            8⤵
                                                                                                              PID:5412
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4168 /prefetch:8
                                                                                                              8⤵
                                                                                                                PID:5444
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4904 /prefetch:8
                                                                                                                8⤵
                                                                                                                  PID:5500
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3980 /prefetch:8
                                                                                                                  8⤵
                                                                                                                    PID:5620
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6064 /prefetch:8
                                                                                                                    8⤵
                                                                                                                      PID:5652
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6052 /prefetch:8
                                                                                                                      8⤵
                                                                                                                        PID:5684
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6112 /prefetch:8
                                                                                                                        8⤵
                                                                                                                          PID:5716
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4912 /prefetch:8
                                                                                                                          8⤵
                                                                                                                            PID:5748
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2300 /prefetch:1
                                                                                                                            8⤵
                                                                                                                              PID:2792
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3648 /prefetch:8
                                                                                                                              8⤵
                                                                                                                                PID:5320
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5248 /prefetch:8
                                                                                                                                8⤵
                                                                                                                                  PID:5436
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6340 /prefetch:8
                                                                                                                                  8⤵
                                                                                                                                    PID:5500
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6384 /prefetch:8
                                                                                                                                    8⤵
                                                                                                                                      PID:5384
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3952 /prefetch:8
                                                                                                                                      8⤵
                                                                                                                                        PID:3996
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3976 /prefetch:8
                                                                                                                                        8⤵
                                                                                                                                          PID:4512
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4216 /prefetch:8
                                                                                                                                          8⤵
                                                                                                                                            PID:5444
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=728 /prefetch:8
                                                                                                                                            8⤵
                                                                                                                                              PID:5668
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
                                                                                                                                              8⤵
                                                                                                                                                PID:5760
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4908 /prefetch:8
                                                                                                                                                8⤵
                                                                                                                                                  PID:4956
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4108 /prefetch:8
                                                                                                                                                  8⤵
                                                                                                                                                    PID:2476
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4252 /prefetch:8
                                                                                                                                                    8⤵
                                                                                                                                                      PID:372
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4888 /prefetch:8
                                                                                                                                                      8⤵
                                                                                                                                                        PID:5612
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
                                                                                                                                                        8⤵
                                                                                                                                                          PID:5568
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 /prefetch:8
                                                                                                                                                          8⤵
                                                                                                                                                            PID:5156
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5068 /prefetch:8
                                                                                                                                                            8⤵
                                                                                                                                                              PID:5752
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
                                                                                                                                                              8⤵
                                                                                                                                                                PID:204
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2492 /prefetch:8
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:1060
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1424,10200868278683666953,6275264898432128304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6200 /prefetch:8
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:4980
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c arnatic_7.exe
                                                                                                                                                            4⤵
                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                            PID:1984
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4E81A044\arnatic_7.exe
                                                                                                                                                              arnatic_7.exe
                                                                                                                                                              5⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                              PID:4012
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4E81A044\arnatic_7.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS4E81A044\arnatic_7.exe
                                                                                                                                                                6⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:2408
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c arnatic_5.exe
                                                                                                                                                            4⤵
                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                            PID:3332
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4E81A044\arnatic_5.exe
                                                                                                                                                              arnatic_5.exe
                                                                                                                                                              5⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:1320
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\4530863.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\4530863.exe"
                                                                                                                                                                6⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:4516
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\7767808.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\7767808.exe"
                                                                                                                                                                6⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                PID:4640
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                  7⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:4732
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\7829592.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\7829592.exe"
                                                                                                                                                                6⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                PID:4852
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\2900343.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\2900343.exe"
                                                                                                                                                                6⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5012
                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                      1⤵
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      PID:4024
                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                        2⤵
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                        PID:4048
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                      1⤵
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:5944
                                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                      1⤵
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      PID:5992
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                      1⤵
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:4776
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                      1⤵
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:3172
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                      1⤵
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:1344
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                      1⤵
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:5032
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                      1⤵
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:5012

                                                                                                                                                    Network

                                                                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                                                                    Replay Monitor

                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                    Downloads

                                                                                                                                                    • memory/68-187-0x0000016F29E40000-0x0000016F29EB1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      452KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/400-290-0x0000000000400000-0x00000000008F4000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      5.0MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/400-289-0x0000000000900000-0x0000000000A4A000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1.3MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/676-218-0x000001443F160000-0x000001443F1D1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      452KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1064-208-0x000001BDEA550000-0x000001BDEA5C1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      452KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1184-247-0x000001D192B10000-0x000001D192B81000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      452KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1224-249-0x000001A59BE70000-0x000001A59BEE1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      452KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1320-176-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1320-166-0x0000000000580000-0x0000000000581000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1320-170-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1320-205-0x000000001B330000-0x000000001B332000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      8KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1320-173-0x0000000000CC0000-0x0000000000CDF000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      124KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1404-226-0x000002923D570000-0x000002923D5E1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      452KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/1820-235-0x0000023E337B0000-0x0000023E33821000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      452KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2088-186-0x0000000004B1A000-0x0000000004C1B000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1.0MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2088-191-0x00000000049D0000-0x0000000004A2D000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      372KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2136-291-0x00000000025B0000-0x000000000264D000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      628KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2136-292-0x0000000000400000-0x0000000000949000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      5.3MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2408-207-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      120KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2408-225-0x00000000056F0000-0x00000000056F1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2408-222-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2408-227-0x0000000005750000-0x0000000005751000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2408-242-0x0000000005A00000-0x0000000005A01000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2408-232-0x00000000057B0000-0x00000000057B1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2408-224-0x00000000057A0000-0x00000000057A1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2424-201-0x0000028DA5540000-0x0000028DA55B1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      452KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2432-193-0x000001498EC00000-0x000001498EC71000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      452KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2432-189-0x000001498E560000-0x000001498E5AC000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      304KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2724-252-0x000001FF60240000-0x000001FF602B1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      452KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2740-246-0x0000019893A40000-0x0000019893AB1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      452KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2852-219-0x0000025F01570000-0x0000025F015E1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      452KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2852-346-0x0000025F01BA0000-0x0000025F01C10000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      448KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2968-133-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      100KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2968-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      100KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2968-134-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      152KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2968-136-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1.1MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2968-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      572KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2968-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1.5MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2968-135-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      100KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/2968-131-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      100KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/3036-300-0x00000000006C0000-0x00000000006D6000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      88KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/3788-325-0x00000000013A0000-0x00000000013A1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/3856-328-0x00000000049D0000-0x0000000004A6D000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      628KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/3856-327-0x00000000048E0000-0x0000000004944000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      400KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/3856-329-0x0000000000400000-0x0000000004429000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      64.2MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4012-167-0x00000000003D0000-0x00000000003D1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4024-343-0x0000014F1B4D0000-0x0000014F1B51B000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      300KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4024-344-0x0000014F1B770000-0x0000014F1B7E0000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      448KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4024-200-0x0000014F1B520000-0x0000014F1B591000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      452KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4048-299-0x000001D665A00000-0x000001D665B06000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1.0MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4048-228-0x000001D663140000-0x000001D6631B1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      452KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4048-298-0x000001D6649F0000-0x000001D664A0B000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      108KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4320-338-0x0000000000430000-0x00000000004DE000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      696KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4320-340-0x0000000001F30000-0x0000000001F42000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4516-258-0x0000000000A20000-0x0000000000A4E000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      184KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4516-259-0x00000000071E0000-0x00000000071E1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4516-260-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4516-256-0x0000000000170000-0x0000000000171000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4612-332-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4640-267-0x0000000002DB0000-0x0000000002DC0000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      64KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4640-266-0x0000000002C90000-0x0000000002C91000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4640-264-0x0000000000C70000-0x0000000000C71000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4640-270-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4640-268-0x000000000E3B0000-0x000000000E3B1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4732-282-0x0000000005290000-0x0000000005291000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4852-288-0x000000001AD50000-0x000000001AD52000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      8KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4920-322-0x0000000004E00000-0x0000000005406000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      6.0MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4924-320-0x00000000773F0000-0x000000007757E000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1.6MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/4924-321-0x0000000005760000-0x0000000005761000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/5008-342-0x0000000004850000-0x00000000048AC000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      368KB

                                                                                                                                                      Download

                                                                                                                                                    • memory/5008-341-0x00000000048F3000-0x00000000049F4000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      1.0MB

                                                                                                                                                      Download

                                                                                                                                                    • memory/5012-297-0x00000000052F0000-0x00000000052F1000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      4KB

                                                                                                                                                      Download