Resubmissions

11-07-2024 05:43

240711-gej4lstgrf 10

06-09-2021 14:13

210906-rjpvrsedbm 10

08-07-2021 11:08

210708-4gztl3mwl6 10

08-07-2021 08:02

210708-klfb4qeda6 10

07-07-2021 09:39

210707-nem57xyvf2 10

06-07-2021 17:51

210706-7pcrmjy3fa 10

06-07-2021 13:45

210706-eybelwcq86 10

Analysis

  • max time kernel
    90s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    02-07-2021 07:35

Errors

Reason
Remote task has failed: Machine shutdown

General

  • Target

    setup_x86_x64_install - копия (10).exe

  • Size

    3.2MB

  • MD5

    3ae1c212119919e5fce71247286f8e0e

  • SHA1

    97c1890ab73c539056f95eafede319df774e9d38

  • SHA256

    30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

  • SHA512

    5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

Malware Config

Extracted

Family

redline

Botnet

ServAni

C2

87.251.71.195:82

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/

rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 10 IoCs
  • ASPack v2.12-2.42 8 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 31 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 9 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
    • Drops file in System32 directory
    PID:928
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2864
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2644
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2616
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2472
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
        1⤵
          PID:2456
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
          1⤵
            PID:1852
          • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (10).exe
            "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (10).exe"
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:4020
            • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
              "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2296
              • C:\Users\Admin\AppData\Local\Temp\7zS8F8D4D14\setup_install.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS8F8D4D14\setup_install.exe"
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:2088
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c arnatic_1.exe
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2320
                  • C:\Users\Admin\AppData\Local\Temp\7zS8F8D4D14\arnatic_1.exe
                    arnatic_1.exe
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2080
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c taskkill /im arnatic_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS8F8D4D14\arnatic_1.exe" & del C:\ProgramData\*.dll & exit
                      6⤵
                        PID:1288
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /im arnatic_1.exe /f
                          7⤵
                          • Kills process with taskkill
                          PID:2652
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout /t 6
                          7⤵
                          • Delays execution with timeout.exe
                          PID:3916
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c arnatic_4.exe
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3776
                    • C:\Users\Admin\AppData\Local\Temp\7zS8F8D4D14\arnatic_4.exe
                      arnatic_4.exe
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:1172
                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                        6⤵
                        • Executes dropped EXE
                        PID:2692
                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                        6⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5028
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c arnatic_6.exe
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1712
                    • C:\Users\Admin\AppData\Local\Temp\7zS8F8D4D14\arnatic_6.exe
                      arnatic_6.exe
                      5⤵
                      • Executes dropped EXE
                      PID:3912
                      • C:\Users\Admin\Documents\PUhItonckYlT1aRnEUlOUlkr.exe
                        "C:\Users\Admin\Documents\PUhItonckYlT1aRnEUlOUlkr.exe"
                        6⤵
                        • Executes dropped EXE
                        PID:3100
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c taskkill /im PUhItonckYlT1aRnEUlOUlkr.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\PUhItonckYlT1aRnEUlOUlkr.exe" & del C:\ProgramData\*.dll & exit
                          7⤵
                            PID:5820
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /im PUhItonckYlT1aRnEUlOUlkr.exe /f
                              8⤵
                              • Kills process with taskkill
                              PID:4048
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout /t 6
                              8⤵
                              • Delays execution with timeout.exe
                              PID:764
                        • C:\Users\Admin\Documents\i4m_YYMLpBj55oL5hYpxUZ6M.exe
                          "C:\Users\Admin\Documents\i4m_YYMLpBj55oL5hYpxUZ6M.exe"
                          6⤵
                          • Executes dropped EXE
                          PID:4740
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c taskkill /im i4m_YYMLpBj55oL5hYpxUZ6M.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\i4m_YYMLpBj55oL5hYpxUZ6M.exe" & del C:\ProgramData\*.dll & exit
                            7⤵
                              PID:5908
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /im i4m_YYMLpBj55oL5hYpxUZ6M.exe /f
                                8⤵
                                • Kills process with taskkill
                                PID:2600
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout /t 6
                                8⤵
                                • Delays execution with timeout.exe
                                PID:5048
                          • C:\Users\Admin\Documents\FlRLlBNxlvi8sACLMz8oHFmC.exe
                            "C:\Users\Admin\Documents\FlRLlBNxlvi8sACLMz8oHFmC.exe"
                            6⤵
                            • Executes dropped EXE
                            PID:3896
                            • C:\Users\Admin\Documents\FlRLlBNxlvi8sACLMz8oHFmC.exe
                              "C:\Users\Admin\Documents\FlRLlBNxlvi8sACLMz8oHFmC.exe"
                              7⤵
                                PID:5432
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 748
                                7⤵
                                • Program crash
                                PID:5556
                            • C:\Users\Admin\Documents\n5JlJK2WbNYqBaytfGrhLLuH.exe
                              "C:\Users\Admin\Documents\n5JlJK2WbNYqBaytfGrhLLuH.exe"
                              6⤵
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              PID:4392
                              • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                7⤵
                                  PID:4812
                                  • C:\Windows\SysWOW64\rUNdlL32.eXe
                                    "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                    8⤵
                                      PID:5924
                                  • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                    7⤵
                                      PID:4996
                                    • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                      "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                      7⤵
                                        PID:3076
                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          8⤵
                                            PID:5180
                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                            8⤵
                                              PID:5592
                                          • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                            "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                            7⤵
                                              PID:4136
                                          • C:\Users\Admin\Documents\yAM0KH4N0vZkjPzwXyMRRtQ5.exe
                                            "C:\Users\Admin\Documents\yAM0KH4N0vZkjPzwXyMRRtQ5.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            PID:2900
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --hold https://ezsearch.ru
                                              7⤵
                                              • Loads dropped DLL
                                              PID:5052
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7fffccea4f50,0x7fffccea4f60,0x7fffccea4f70
                                                8⤵
                                                  PID:4456
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1856 /prefetch:8
                                                  8⤵
                                                    PID:3408
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1868 /prefetch:8
                                                    8⤵
                                                      PID:2632
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1808 /prefetch:2
                                                      8⤵
                                                        PID:4904
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2860 /prefetch:1
                                                        8⤵
                                                          PID:1152
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2868 /prefetch:1
                                                          8⤵
                                                            PID:3796
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
                                                            8⤵
                                                              PID:4288
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
                                                              8⤵
                                                                PID:4680
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
                                                                8⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                PID:5088
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
                                                                8⤵
                                                                  PID:3900
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4736 /prefetch:8
                                                                  8⤵
                                                                    PID:5208
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
                                                                    8⤵
                                                                      PID:3872
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4044 /prefetch:8
                                                                      8⤵
                                                                        PID:3512
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3732 /prefetch:8
                                                                        8⤵
                                                                          PID:2624
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4004 /prefetch:8
                                                                          8⤵
                                                                            PID:5780
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4144 /prefetch:8
                                                                            8⤵
                                                                              PID:5648
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3440 /prefetch:8
                                                                              8⤵
                                                                                PID:5032
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3848 /prefetch:8
                                                                                8⤵
                                                                                  PID:6068
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3692 /prefetch:8
                                                                                  8⤵
                                                                                    PID:5948
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3516 /prefetch:8
                                                                                    8⤵
                                                                                      PID:5420
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3940 /prefetch:8
                                                                                      8⤵
                                                                                        PID:5924
                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                                                                        8⤵
                                                                                          PID:5188
                                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x258,0x25c,0x260,0x234,0x264,0x7ff79dc1a890,0x7ff79dc1a8a0,0x7ff79dc1a8b0
                                                                                            9⤵
                                                                                              PID:5824
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3500 /prefetch:8
                                                                                            8⤵
                                                                                              PID:700
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3656 /prefetch:8
                                                                                              8⤵
                                                                                                PID:5396
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3512 /prefetch:8
                                                                                                8⤵
                                                                                                  PID:1804
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3828 /prefetch:8
                                                                                                  8⤵
                                                                                                    PID:4052
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5240 /prefetch:8
                                                                                                    8⤵
                                                                                                      PID:5444
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5300 /prefetch:8
                                                                                                      8⤵
                                                                                                        PID:5448
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5404 /prefetch:8
                                                                                                        8⤵
                                                                                                          PID:5980
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4800 /prefetch:8
                                                                                                          8⤵
                                                                                                            PID:5168
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5220 /prefetch:8
                                                                                                            8⤵
                                                                                                              PID:5176
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5416 /prefetch:8
                                                                                                              8⤵
                                                                                                                PID:5716
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4116 /prefetch:8
                                                                                                                8⤵
                                                                                                                  PID:4624
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5672 /prefetch:8
                                                                                                                  8⤵
                                                                                                                    PID:2340
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3812 /prefetch:8
                                                                                                                    8⤵
                                                                                                                      PID:2676
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6180 /prefetch:8
                                                                                                                      8⤵
                                                                                                                        PID:4136
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4160 /prefetch:8
                                                                                                                        8⤵
                                                                                                                          PID:2080
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6432 /prefetch:8
                                                                                                                          8⤵
                                                                                                                            PID:5380
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6420 /prefetch:8
                                                                                                                            8⤵
                                                                                                                              PID:5740
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6680 /prefetch:8
                                                                                                                              8⤵
                                                                                                                                PID:5636
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6816 /prefetch:8
                                                                                                                                8⤵
                                                                                                                                  PID:5908
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6688 /prefetch:8
                                                                                                                                  8⤵
                                                                                                                                    PID:5216
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7096 /prefetch:8
                                                                                                                                    8⤵
                                                                                                                                      PID:5644
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7088 /prefetch:8
                                                                                                                                      8⤵
                                                                                                                                        PID:2776
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7344 /prefetch:8
                                                                                                                                        8⤵
                                                                                                                                          PID:5876
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7328 /prefetch:8
                                                                                                                                          8⤵
                                                                                                                                            PID:5880
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7612 /prefetch:8
                                                                                                                                            8⤵
                                                                                                                                              PID:5552
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7752 /prefetch:8
                                                                                                                                              8⤵
                                                                                                                                                PID:784
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6184 /prefetch:8
                                                                                                                                                8⤵
                                                                                                                                                  PID:3548
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5852 /prefetch:8
                                                                                                                                                  8⤵
                                                                                                                                                    PID:5800
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:1
                                                                                                                                                    8⤵
                                                                                                                                                      PID:5772
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7616 /prefetch:1
                                                                                                                                                      8⤵
                                                                                                                                                        PID:5300
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1764,6460467076530147762,15429604900490985756,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:1
                                                                                                                                                        8⤵
                                                                                                                                                          PID:5940
                                                                                                                                                    • C:\Users\Admin\Documents\UgQiqY2ksPp5YaepPlQf0dGd.exe
                                                                                                                                                      "C:\Users\Admin\Documents\UgQiqY2ksPp5YaepPlQf0dGd.exe"
                                                                                                                                                      6⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4444
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 664
                                                                                                                                                        7⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        PID:4608
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 668
                                                                                                                                                        7⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        PID:1788
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 676
                                                                                                                                                        7⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        PID:4164
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 736
                                                                                                                                                        7⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        PID:4832
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1052
                                                                                                                                                        7⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        PID:5252
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1260
                                                                                                                                                        7⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        PID:5584
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1300
                                                                                                                                                        7⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        PID:5828
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1320
                                                                                                                                                        7⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        PID:6116
                                                                                                                                                    • C:\Users\Admin\Documents\KeCG06xYbamW7t6Brl6XYILu.exe
                                                                                                                                                      "C:\Users\Admin\Documents\KeCG06xYbamW7t6Brl6XYILu.exe"
                                                                                                                                                      6⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4972
                                                                                                                                                      • C:\Users\Admin\Documents\KeCG06xYbamW7t6Brl6XYILu.exe
                                                                                                                                                        C:\Users\Admin\Documents\KeCG06xYbamW7t6Brl6XYILu.exe
                                                                                                                                                        7⤵
                                                                                                                                                          PID:5668
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im KeCG06xYbamW7t6Brl6XYILu.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\KeCG06xYbamW7t6Brl6XYILu.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                            8⤵
                                                                                                                                                              PID:5252
                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                taskkill /im KeCG06xYbamW7t6Brl6XYILu.exe /f
                                                                                                                                                                9⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                PID:5624
                                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                timeout /t 6
                                                                                                                                                                9⤵
                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                PID:4788
                                                                                                                                                          • C:\Users\Admin\Documents\KeCG06xYbamW7t6Brl6XYILu.exe
                                                                                                                                                            C:\Users\Admin\Documents\KeCG06xYbamW7t6Brl6XYILu.exe
                                                                                                                                                            7⤵
                                                                                                                                                              PID:5652
                                                                                                                                                          • C:\Users\Admin\Documents\HciXxtUZs7W50HCnM3bnavOG.exe
                                                                                                                                                            "C:\Users\Admin\Documents\HciXxtUZs7W50HCnM3bnavOG.exe"
                                                                                                                                                            6⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:4368
                                                                                                                                                            • C:\Users\Admin\Documents\HciXxtUZs7W50HCnM3bnavOG.exe
                                                                                                                                                              C:\Users\Admin\Documents\HciXxtUZs7W50HCnM3bnavOG.exe
                                                                                                                                                              7⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:1596
                                                                                                                                                            • C:\Users\Admin\Documents\HciXxtUZs7W50HCnM3bnavOG.exe
                                                                                                                                                              C:\Users\Admin\Documents\HciXxtUZs7W50HCnM3bnavOG.exe
                                                                                                                                                              7⤵
                                                                                                                                                                PID:4152
                                                                                                                                                              • C:\Users\Admin\Documents\HciXxtUZs7W50HCnM3bnavOG.exe
                                                                                                                                                                C:\Users\Admin\Documents\HciXxtUZs7W50HCnM3bnavOG.exe
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:372
                                                                                                                                                              • C:\Users\Admin\Documents\gU0gqbr2b7xMrhHL8NdZ0wcM.exe
                                                                                                                                                                "C:\Users\Admin\Documents\gU0gqbr2b7xMrhHL8NdZ0wcM.exe"
                                                                                                                                                                6⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:2332
                                                                                                                                                                • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:5560
                                                                                                                                                                • C:\Users\Admin\Documents\LJVFd63Ru8po9MpWI0rDQAce.exe
                                                                                                                                                                  "C:\Users\Admin\Documents\LJVFd63Ru8po9MpWI0rDQAce.exe"
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:5088
                                                                                                                                                                    • C:\Users\Admin\Documents\LJVFd63Ru8po9MpWI0rDQAce.exe
                                                                                                                                                                      C:\Users\Admin\Documents\LJVFd63Ru8po9MpWI0rDQAce.exe
                                                                                                                                                                      7⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:4600
                                                                                                                                                                  • C:\Users\Admin\Documents\D4tc74IyRZGAl6gsPbWwA61h.exe
                                                                                                                                                                    "C:\Users\Admin\Documents\D4tc74IyRZGAl6gsPbWwA61h.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                    PID:2280
                                                                                                                                                                  • C:\Users\Admin\Documents\iv38u3vitO54MyqcnVi5ITMw.exe
                                                                                                                                                                    "C:\Users\Admin\Documents\iv38u3vitO54MyqcnVi5ITMw.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:2248
                                                                                                                                                                    • C:\Users\Admin\Documents\iv38u3vitO54MyqcnVi5ITMw.exe
                                                                                                                                                                      "{path}"
                                                                                                                                                                      7⤵
                                                                                                                                                                        PID:5964
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c arnatic_7.exe
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                  PID:1176
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8F8D4D14\arnatic_7.exe
                                                                                                                                                                    arnatic_7.exe
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                    PID:3484
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c arnatic_5.exe
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                  PID:2652
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c arnatic_3.exe
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                  PID:1872
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c arnatic_2.exe
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                  PID:2408
                                                                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1352
                                                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                                                                                                                                              1⤵
                                                                                                                                                                PID:1276
                                                                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:1228
                                                                                                                                                                • c:\windows\system32\svchost.exe
                                                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:1104
                                                                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:352
                                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                      PID:3908
                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                        PID:2528
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8F8D4D14\arnatic_5.exe
                                                                                                                                                                      arnatic_5.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:2776
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\3324617.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\3324617.exe"
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                        PID:4240
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\3996470.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\3996470.exe"
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                        PID:4276
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:4952
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\2129644.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\2129644.exe"
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                        PID:4396
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\3019896.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\3019896.exe"
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        PID:4344
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8F8D4D14\arnatic_2.exe
                                                                                                                                                                      arnatic_2.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                      PID:2216
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8F8D4D14\arnatic_7.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7zS8F8D4D14\arnatic_7.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:3676
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8F8D4D14\arnatic_3.exe
                                                                                                                                                                      arnatic_3.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                      PID:1044
                                                                                                                                                                      • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                        PID:2600
                                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:5696
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8E5.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\8E5.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:3708

                                                                                                                                                                        Network

                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                        Replay Monitor

                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                        Downloads

                                                                                                                                                                        • memory/352-193-0x000001E078E40000-0x000001E078EB1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/928-233-0x000002085A440000-0x000002085A4B1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/1104-219-0x0000026B11320000-0x0000026B11391000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/1228-270-0x0000015777240000-0x00000157772B1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/1276-281-0x000001C197B60000-0x000001C197BD1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/1352-251-0x000001A927A50000-0x000001A927AC1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/1852-261-0x000001AD22F50000-0x000001AD22FC1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/2080-294-0x0000000002570000-0x000000000260D000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          628KB

                                                                                                                                                                        • memory/2080-296-0x0000000000400000-0x0000000000949000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          5.3MB

                                                                                                                                                                        • memory/2088-132-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          152KB

                                                                                                                                                                        • memory/2088-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          572KB

                                                                                                                                                                        • memory/2088-165-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          100KB

                                                                                                                                                                        • memory/2088-133-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.1MB

                                                                                                                                                                        • memory/2088-168-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          100KB

                                                                                                                                                                        • memory/2088-167-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          100KB

                                                                                                                                                                        • memory/2088-163-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          100KB

                                                                                                                                                                        • memory/2088-131-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.5MB

                                                                                                                                                                        • memory/2216-297-0x0000000000400000-0x00000000008F4000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          5.0MB

                                                                                                                                                                        • memory/2216-295-0x00000000001E0000-0x00000000001E9000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          36KB

                                                                                                                                                                        • memory/2248-333-0x0000000005580000-0x0000000005581000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/2280-334-0x0000000077870000-0x00000000779FE000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.6MB

                                                                                                                                                                        • memory/2280-344-0x00000000054D0000-0x00000000054D1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/2456-200-0x00000122DDF60000-0x00000122DDFAC000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          304KB

                                                                                                                                                                        • memory/2456-204-0x00000122DE830000-0x00000122DE8A1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/2472-212-0x000001B8EADD0000-0x000001B8EAE41000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/2528-301-0x000002A3A9100000-0x000002A3A9206000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.0MB

                                                                                                                                                                        • memory/2528-300-0x000002A3A6860000-0x000002A3A687B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          108KB

                                                                                                                                                                        • memory/2528-249-0x000002A3A6770000-0x000002A3A67E1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/2600-191-0x00000000041B0000-0x00000000042B1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.0MB

                                                                                                                                                                        • memory/2600-195-0x0000000004140000-0x000000000419D000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          372KB

                                                                                                                                                                        • memory/2616-283-0x000001C469900000-0x000001C469971000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/2644-280-0x000001BE65C40000-0x000001BE65CB1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/2776-173-0x000000001AE20000-0x000000001AE22000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          8KB

                                                                                                                                                                        • memory/2776-172-0x00000000008F0000-0x00000000008F1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/2776-155-0x0000000000130000-0x0000000000131000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/2776-164-0x0000000000650000-0x0000000000651000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/2776-171-0x0000000000860000-0x000000000087F000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          124KB

                                                                                                                                                                        • memory/2864-239-0x000001EB92840000-0x000001EB928B1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/3064-302-0x00000000007A0000-0x00000000007B6000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          88KB

                                                                                                                                                                        • memory/3100-342-0x00000000047F0000-0x000000000488D000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          628KB

                                                                                                                                                                        • memory/3100-339-0x0000000004540000-0x000000000468A000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.3MB

                                                                                                                                                                        • memory/3100-349-0x0000000000400000-0x000000000442B000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64.2MB

                                                                                                                                                                        • memory/3484-169-0x00000000003D0000-0x00000000003D1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/3676-211-0x00000000055E0000-0x00000000055E1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/3676-192-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          120KB

                                                                                                                                                                        • memory/3676-221-0x00000000056D0000-0x00000000056D1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/3676-213-0x0000000005640000-0x0000000005641000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/3676-265-0x00000000058F0000-0x00000000058F1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/3676-208-0x00000000056C0000-0x00000000056C1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/3676-207-0x0000000005CE0000-0x0000000005CE1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/3908-205-0x0000020B7F410000-0x0000020B7F481000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          452KB

                                                                                                                                                                        • memory/4136-346-0x0000000000740000-0x0000000000750000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/4136-348-0x0000000000770000-0x0000000000782000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          72KB

                                                                                                                                                                        • memory/4240-269-0x0000000002AC0000-0x0000000002AEE000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          184KB

                                                                                                                                                                        • memory/4240-247-0x00000000053A0000-0x00000000053A1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4240-225-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4276-266-0x000000000DE20000-0x000000000DE21000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4276-262-0x000000000E320000-0x000000000E321000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4276-237-0x0000000000B20000-0x0000000000B21000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4276-273-0x0000000001380000-0x0000000001381000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4276-260-0x0000000001430000-0x0000000001440000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/4276-252-0x0000000001420000-0x0000000001421000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4344-253-0x00000000005E0000-0x00000000005E1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4344-238-0x00000000004B0000-0x00000000004B1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4344-279-0x0000000000BD0000-0x0000000000C02000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          200KB

                                                                                                                                                                        • memory/4344-258-0x000000001B0C0000-0x000000001B0C2000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          8KB

                                                                                                                                                                        • memory/4368-336-0x0000000000F80000-0x0000000000FF6000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          472KB

                                                                                                                                                                        • memory/4396-268-0x00000000058E0000-0x00000000058E1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4396-248-0x0000000000F80000-0x0000000000F81000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4396-259-0x00000000017E0000-0x00000000017E1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4444-337-0x0000000004720000-0x000000000474F000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          188KB

                                                                                                                                                                        • memory/4444-338-0x0000000000400000-0x00000000043D1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          63.8MB

                                                                                                                                                                        • memory/4600-353-0x0000000004B30000-0x0000000005136000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          6.0MB

                                                                                                                                                                        • memory/4740-355-0x00000000046C0000-0x000000000475D000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          628KB

                                                                                                                                                                        • memory/4740-356-0x0000000000400000-0x0000000004429000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64.2MB

                                                                                                                                                                        • memory/4740-354-0x0000000004430000-0x000000000457A000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          1.3MB

                                                                                                                                                                        • memory/4952-288-0x0000000002910000-0x0000000002911000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/4972-332-0x00000000049F0000-0x00000000049F1000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                        • memory/5088-335-0x0000000004E40000-0x0000000004E41000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB